fittings-time-sunrise-sunset

Warn

Audited by Socket on Aug 17, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: The skill’s purpose and API endpoint are coherent, but its trust model is weak. The main issue is a same-domain yet unverifiable downloaded script that is then executed locally and may receive a wallet private key for payment signing. That combination is disproportionate for a basic sunrise/sunset lookup and creates substantial supply-chain and credential-forwarding risk, even though the service itself appears legitimate.

Confidence: 89%Severity: 84%
Audit Metadata
Analyzed At
Aug 17, 2026, 10:34 PM
Package URL
pkg:socket/skills-sh/fittings-sh%2Ffittings%2Ffittings-time-sunrise-sunset%2F@7790b23c26fd2b026503a2133fce4325f0c1c9a0d1117d95a46ee2b0c060903f