Shipcheck

• Analyzed: May 13, 2026, 10:36 AM
• Findings: 1
• Version: 0.1.0
• Hash: 033446c85a8ebcc6dfad87014d8e1e85f47a67f5ac4ac4f2dc7ace3e277ebb77
• Source: palm
• External report: View on VirusTotal

Findings (1)

The shipcheck skill is a pre-publish security utility designed to scan npm packages and repositories for sensitive information (PII, API keys, internal IPs) before publication. It functions as a wrapper for the `@symbolstar/shipcheck` CLI tool and provides clear instructions for the AI agent to trigger scans during sensitive operations like `npm publish` or `git push`. No evidence of malicious intent, data exfiltration, or harmful prompt injection was found in the skill definition or instructions.