fittings-epa-tri-facilities
Warn
Audited by Socket on Aug 17, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS. The core lookup purpose is plausible, but the skill relies on a remote downloaded helper script from fittings.sh and then asks that helper to handle a wallet private key for paid access to otherwise public EPA-derived data. The intermediary data flow and autonomous payment behavior are coherent with the service model but disproportionate to a simple facility lookup, and the unverifiable script plus credential forwarding makes the overall risk high.
Confidence: 84%Severity: 86%
Audit Metadata