skills/dl-alexandre/skills/mpr-cli/Socket

mpr-cli

Warn

Audited by Socket on Sep 20, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The stated purpose is coherent with USDA commodity-data access, but the skill’s core dependency is an unverified `mpr` executable not tied to official USDA distribution. That makes the main risk supply-chain trust and credential forwarding: the USDA API key is handed to a black-box CLI whose provenance the skill does not justify.

Confidence: 91%Severity: 84%

Audit Metadata

Analyzed At

Sep 20, 2026, 03:08 AM

Package URL

pkg:socket/skills-sh/dl-alexandre%2Fskills%2Fmpr-cli%2F@d4006f1bb5c419366fae2674644fae1d2ff585aa097e646cbc09efba063da3e2