skills/fittings-sh/fittings/fittings-cve-lookup/Socket

fittings-cve-lookup

Warn

Audited by Socket on Aug 17, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the core purpose is coherent, and the network endpoints appear to match the advertised fittings.sh service, but the skill mixes a simple CVE lookup with remote script download and wallet-key-based payment signing. The main concern is supply-chain and credential-handling risk from executing vendor-hosted call.mjs and giving it a private key.

Confidence: 84%Severity: 58%

Audit Metadata

Analyzed At

Aug 17, 2026, 10:32 PM

Package URL

pkg:socket/skills-sh/fittings-sh%2Ffittings%2Ffittings-cve-lookup%2F@940fc912d27bbc9b390aa3bb461037c8ecaa2580ac2e576ec4a0ae5abbc041aa