crossref-search

Warn

Audited by Socket on Aug 18, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The stated purpose is simple citation lookup, but the skill routes requests through a third-party gateway, instructs execution of an unverified remote script, and forwards a wallet private key to that client for payment signing. The functionality is plausible, but the install trust and credential scope are disproportionate to the task.

Confidence: 90%Severity: 84%
Audit Metadata
Analyzed At
Aug 18, 2026, 05:16 AM
Package URL
pkg:socket/skills-sh/fittings-sh%2Fskills%2Fcrossref-search%2F@b8b3018113b3bfad48380a94493a27ba3e55e86a9d9d6f18ee7b660c96d9161a