skills/fittings-sh/skills/epss-score/Socket

epss-score

Warn

Audited by Socket on Aug 18, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The core purpose is plausible, but the skill mixes a simple EPSS lookup with a direct-download helper, third-party gateway routing, and forwarding of a plaintext wallet private key for payment signing. Those capabilities are disproportionate to a read-only vulnerability score lookup and create meaningful supply-chain and credential-handling risk.

Confidence: 87%Severity: 84%

Audit Metadata

Analyzed At

Aug 18, 2026, 05:17 AM

Package URL

pkg:socket/skills-sh/fittings-sh%2Fskills%2Fepss-score%2F@55e525bd41f0fe4e17435b3886c011208cbc160636913d16537efd14c30f982d