fittings-weather

Warn

Audited by Socket on Aug 17, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The core mismatch is not the weather functionality itself, but that all official-feed claims are funneled through a third-party gateway and the skill requests a raw USDC wallet private key to use it. That combination is high-risk and disproportionate for an information lookup skill, even without overt malware or a dangerous installer.

Confidence: 90%Severity: 83%
Audit Metadata
Analyzed At
Aug 17, 2026, 10:33 PM
Package URL
pkg:socket/skills-sh/fittings-sh%2Ffittings%2Ffittings-weather%2F@5fee1af39b56a020736abb2c5f06887b88b47d748370c2e66d978cc2ee1d094e