skills/cryptopafi/nexusos-skills/travel/Socket

travel

Warn

Audited by Socket on Sep 11, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The travel purpose is plausible, but the skill’s trust model is not proportionate: it harvests API keys from local secret stores and forwards them into unverifiable local binaries and scripts, then publishes output to a raw-IP HTTP endpoint. The main issue is not trip planning itself but credential forwarding and opaque execution paths.

Confidence: 89%Severity: 86%

Audit Metadata

Analyzed At

Sep 11, 2026, 10:37 AM

Package URL

pkg:socket/skills-sh/cryptopafi%2Fnexusos-skills%2Ftravel%2F@d533f426db95958e43213516f69f85b33b74a550fc3396a6b60c819ec1365bb7