Shippo

• Analyzed: May 13, 2026, 3:56 PM
• Findings: 1
• Version: 1.1.3
• Hash: a40bf418f59f1bba91377d16a7572da7d582601db6f5b9b3ab48bd64b5e811db
• Source: palm
• External report: View on VirusTotal

Findings (1)

The goshippo skill bundle is a legitimate integration for the Shippo shipping API, providing tools for address validation, rate shopping, and label generation. The documentation (SKILL.md and various reference files) includes clear security practices, such as requiring explicit user confirmation before financial transactions and distinguishing between test and live environments. The use of the Gram MCP gateway and the @shippo/shippo-mcp npm package is well-documented with a self-hosting alternative provided, and no evidence of malicious intent or data exfiltration was found.