fittings-water-usgs-streamflow

Warn

Audited by Socket on Aug 17, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: The stated purpose is coherent, but the skill’s trust model is risky. It combines a raw remote script download with forwarding a blockchain private key into that client and an intermediary payment gateway, which is disproportionate for simply retrieving public USGS data. Same-domain provenance reduces malicious certainty, but the unverifiable installer and key-based payment flow make this high security risk.

Confidence: 88%Severity: 83%
Audit Metadata
Analyzed At
Aug 17, 2026, 10:34 PM
Package URL
pkg:socket/skills-sh/fittings-sh%2Ffittings%2Ffittings-water-usgs-streamflow%2F@0b096a6ab0d0711c8c7e218aa877a462a9fc5cff4c1eb304f509427707e3f641