goose

Warn

Audited by Socket on Apr 23, 2026

1 alert found:

Anomaly
AnomalyLOW
SKILL.md

SUSPICIOUS: the Membrane CLI install path appears broadly legitimate and same-brand, but the skill has a material identity/data-flow inconsistency. It describes a Goose SaaS yet cites unrelated Goose docs, and all authentication plus app access is routed through Membrane rather than a verified official Goose API. This is more consistent with an opaque third-party gateway integration than a clearly scoped first-party service skill.

Confidence: 89%Severity: 64%
Audit Metadata
Analyzed At
Apr 23, 2026, 09:56 AM
Package URL
pkg:socket/skills-sh/membranedev%2Fapplication-skills%2Fgoose%2F@afd10bc06faff91a1578da83fc131cfdc85f380b