skills/fittings-sh/fittings/fittings-text-char-edit/Socket

fittings-text-char-edit

Warn

Audited by Socket on Aug 17, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The core API purpose is coherent, but the skill couples a simple text-edit service to an unverifiable downloaded helper and forwards a blockchain private key to that code. Same-domain routing reduces signs of outright credential harvesting, yet the install/execution trust and credential-forwarding footprint are disproportionate for this task.

Confidence: 85%Severity: 83%

Audit Metadata

Analyzed At

Aug 17, 2026, 10:34 PM

Package URL

pkg:socket/skills-sh/fittings-sh%2Ffittings%2Ffittings-text-char-edit%2F@90361ad62560c2e163d324ca9e98fc71b2a403be7b9befab361c0cfad06d90fe