fittings-drought-severity

Warn

Audited by Socket on Aug 17, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the stated drought-data purpose is coherent, but the skill relies on an unpinned remote helper script and asks for a plaintext wallet private key to enable paid calls. Data flow to fittings.sh is consistent with the service, yet install trust and autonomous payment authorization make the skill materially risky.

Confidence: 84%Severity: 78%
Audit Metadata
Analyzed At
Aug 17, 2026, 10:33 PM
Package URL
pkg:socket/skills-sh/fittings-sh%2Ffittings%2Ffittings-drought-severity%2F@bd6abe17d0f44978cd6d997eb678cb9bcc86204fcf641566638e701dc5b0f724