fittings-drought-severity
Warn
Audited by Socket on Aug 17, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS: the stated drought-data purpose is coherent, but the skill relies on an unpinned remote helper script and asks for a plaintext wallet private key to enable paid calls. Data flow to fittings.sh is consistent with the service, yet install trust and autonomous payment authorization make the skill materially risky.
Confidence: 84%Severity: 78%
Audit Metadata