skills/fittings-sh/skills/drought-severity/Socket

drought-severity

Warn

Audited by Socket on Aug 18, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The data-query purpose is coherent, but the trust model is not proportionate: the skill asks the agent to download an unverified helper script and then hand it a plaintext wallet private key for payment signing. That combination makes the main risk credential/signing abuse through third-party code rather than the drought API itself.

Confidence: 88%Severity: 84%

Audit Metadata

Analyzed At

Aug 18, 2026, 05:17 AM

Package URL

pkg:socket/skills-sh/fittings-sh%2Fskills%2Fdrought-severity%2F@e1bb367e0423c85359494cd2b4a1fb197acf40d4723001a9e07bfb37f2146474