cpi-adjust

Warn

Audited by Socket on Aug 18, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the stated CPI-adjustment purpose is coherent, but the skill’s actual footprint is not well-contained because it relies on an unverifiable remote helper script and forwards a blockchain private key to code that cannot be independently audited. The payment flow may be genuine, yet the combination of download-and-execute plus credential forwarding makes this high risk.

Confidence: 87%Severity: 84%
Audit Metadata
Analyzed At
Aug 18, 2026, 05:17 AM
Package URL
pkg:socket/skills-sh/fittings-sh%2Fskills%2Fcpi-adjust%2F@4faf4d790347c02a32eb3baf210d092b745bd314ac988c22c13430c464fe5bf0