fittings-water-usgs-streamflow
Warn
Audited by Socket on Aug 17, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS: The stated purpose is coherent, but the skill’s trust model is risky. It combines a raw remote script download with forwarding a blockchain private key into that client and an intermediary payment gateway, which is disproportionate for simply retrieving public USGS data. Same-domain provenance reduces malicious certainty, but the unverifiable installer and key-based payment flow make this high security risk.
Confidence: 88%Severity: 83%
Audit Metadata