census-geography-bundle

Warn

Audited by Socket on Aug 18, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The stated geography-lookup purpose is plausible, but the skill’s actual footprint includes downloading unpinned executable code from the service domain and passing a plaintext wallet private key to that helper. The third-party gateway model may be legitimate, yet the install trust and credential-forwarding design are disproportionate to a simple Census lookup and create high security risk.

Confidence: 85%Severity: 84%
Audit Metadata
Analyzed At
Aug 18, 2026, 05:19 AM
Package URL
pkg:socket/skills-sh/fittings-sh%2Fskills%2Fcensus-geography-bundle%2F@d36c59c3bc3731149c7e89b57b31d7f1a828e9bfd18873ddff3a15bd6b05b4b7