fittings-nws-point-forecast

Warn

Audited by Socket on Aug 17, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The stated purpose is coherent, but the skill’s trust model is disproportionate: it asks the agent to download and run an unpinned remote script, then hand that script a plaintext wallet private key to enable paid calls. The weather functionality is plausible, yet the install and credential-forwarding path materially increases risk beyond what a simple forecast skill should require.

Confidence: 88%Severity: 84%
Audit Metadata
Analyzed At
Aug 17, 2026, 10:34 PM
Package URL
pkg:socket/skills-sh/fittings-sh%2Ffittings%2Ffittings-nws-point-forecast%2F@37cd4316f9a58c7fda78e25920711c6ba612cbdda911d429faca0305f4fd3ae8