goose
Warn
Audited by Socket on Apr 23, 2026
1 alert found:
AnomalyAnomalySKILL.md
LOWAnomalyLOW
SKILL.md
SUSPICIOUS: the Membrane CLI install path appears broadly legitimate and same-brand, but the skill has a material identity/data-flow inconsistency. It describes a Goose SaaS yet cites unrelated Goose docs, and all authentication plus app access is routed through Membrane rather than a verified official Goose API. This is more consistent with an opaque third-party gateway integration than a clearly scoped first-party service skill.
Confidence: 89%Severity: 64%
Audit Metadata