7shifts

Warn

Audited by Socket on Mar 4, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

This skill is a documentation/integration manifest for interacting with 7shifts via the Membrane platform and CLI. Its stated capabilities align with the documented operations (listing/running actions and using a proxy for arbitrary API calls). There are no signs of hidden backdoors, obfuscated code, credential-harvesting endpoints, or direct execution of untrusted payloads in the provided text. The primary security concerns are supply-chain trust in the Membrane CLI (npm global install) and the centralized handling of credentials by Membrane's backend when using the proxy and connectors — both are expected for this integration but require trusting the Membrane service. Overall: functional and coherent for its purpose, with moderate supply-chain/trust considerations but no overtly malicious behavior in the provided content.

Confidence: 75%Severity: 75%
Audit Metadata
Analyzed At
Mar 4, 2026, 08:57 AM
Package URL
pkg:socket/skills-sh/membranedev%2Fapplication-skills%2F7shifts%2F@653c34d0facb35ef1a245d32d9636ebb78a77a67