fittings-epa-tri-facilities

Warn

Audited by Socket on Aug 17, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The core lookup purpose is plausible, but the skill relies on a remote downloaded helper script from fittings.sh and then asks that helper to handle a wallet private key for paid access to otherwise public EPA-derived data. The intermediary data flow and autonomous payment behavior are coherent with the service model but disproportionate to a simple facility lookup, and the unverifiable script plus credential forwarding makes the overall risk high.

Confidence: 84%Severity: 86%
Audit Metadata
Analyzed At
Aug 17, 2026, 10:33 PM
Package URL
pkg:socket/skills-sh/fittings-sh%2Ffittings%2Ffittings-epa-tri-facilities%2F@bb8f3b9fcfa584cced45b688a9c5a74d88e6651169502a04790de627f45dfac8