crossref-search
Warn
Audited by Socket on Aug 18, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS. The stated purpose is simple citation lookup, but the skill routes requests through a third-party gateway, instructs execution of an unverified remote script, and forwards a wallet private key to that client for payment signing. The functionality is plausible, but the install trust and credential scope are disproportionate to the task.
Confidence: 90%Severity: 84%
Audit Metadata