fittings-energy-uk-carbon-intensity

Warn

Audited by Socket on Aug 17, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The stated purpose is coherent, but the skill’s operational model depends on a remotely downloaded, unverifiable client script and forwards a wallet private key into that client for paid calls. Data flow through fittings.sh is plausible for a metered gateway, yet the combination of remote download, credential handling, and autonomous spending makes the skill higher risk than its simple API purpose suggests.

Confidence: 84%Severity: 82%
Audit Metadata
Analyzed At
Aug 17, 2026, 10:33 PM
Package URL
pkg:socket/skills-sh/fittings-sh%2Ffittings%2Ffittings-energy-uk-carbon-intensity%2F@7ec1a78c72572c095c405a34fe343fcbbfe2608d8b432f3779d2fa82df287413