fittings-orcid-researcher-profile

Warn

Audited by Socket on Aug 17, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The core lookup purpose is plausible, but the skill routes a public-data query through a paid third-party gateway, asks for a blockchain private key, and optionally downloads executable helper code from that same service. This is not confirmed malware, but the install trust, credential exposure, and autonomous payment behavior are disproportionate to a simple ORCID profile lookup.

Confidence: 82%Severity: 74%
Audit Metadata
Analyzed At
Aug 17, 2026, 10:34 PM
Package URL
pkg:socket/skills-sh/fittings-sh%2Ffittings%2Ffittings-orcid-researcher-profile%2F@4270925b08cff71fd9bf7cabde61437707ea68d76ba106b1f421b87fe16c61b1