fittings-fx-ecb-rate

Warn

Audited by Socket on Aug 17, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The skill’s FX-rate purpose is coherent, but its paid path relies on downloading and executing an unpinned remote script that is then given a wallet private key. Same-domain provenance helps, yet the combination of remote code execution, credential forwarding, and autonomous payment makes the overall risk high relative to the narrow purpose.

Confidence: 85%Severity: 84%
Audit Metadata
Analyzed At
Aug 17, 2026, 10:32 PM
Package URL
pkg:socket/skills-sh/fittings-sh%2Ffittings%2Ffittings-fx-ecb-rate%2F@7a6cd838e44070b2482a020e5cd0847569f8efc63ec385682dc35cacb90442bd