skills/membranedev/application-skills/shotstack/Socket

shotstack

Warn

Audited by Socket on Mar 27, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill is not overtly malicious and uses an official npm-distributed CLI, but it is internally inconsistent and expands trust by routing Shotstack access through Membrane as an intermediary. Overall risk is medium due to third-party proxying, mutable installs, and mismatched purpose text rather than confirmed malware.

Confidence: 84%Severity: 56%

Audit Metadata

Analyzed At

Mar 27, 2026, 10:29 PM

Package URL

pkg:socket/skills-sh/membranedev%2Fapplication-skills%2Fshotstack%2F@7d05c60159e0b6213a5a08aa027091247824c67b