fema-disaster-declarations

Warn

Audited by Socket on Aug 18, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the stated FEMA lookup purpose is plausible, but the actual footprint includes remote code download, third-party gateway dependence, and forwarding wallet-signing capability to service-supplied client code. The core mismatch is a public-data lookup requiring crypto payment infrastructure and plaintext private-key handling through unverifiable executable code.

Confidence: 89%Severity: 83%
Audit Metadata
Analyzed At
Aug 18, 2026, 05:17 AM
Package URL
pkg:socket/skills-sh/fittings-sh%2Fskills%2Ffema-disaster-declarations%2F@46771fd548a1cdfeba9174c56c67869c66a22012ca726d41abae4d8049559bcd