ethermail

Warn

Audited by Socket on Oct 4, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The EtherMail purpose is plausible, but the skill’s core login path depends on installing a separate third-party skill and handing it a raw Ethereum private key. That transitive dependency and credential forwarding are disproportionate to the stated purpose and create a high-risk supply-chain/credential-theft scenario, even though the EtherMail and WalletConnect concepts themselves are legitimate.

Confidence: 92%Severity: 90%
Audit Metadata
Analyzed At
Oct 4, 2026, 08:44 AM
Package URL
pkg:socket/skills-sh/daaab%2Fagent-skills%2Fethermail%2F@298db05b850763f195241e043492790dca8a717080c709a22ba4bbba310a7af7