geo-forward-geocode

Warn

Audited by Socket on Aug 18, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the geocoding purpose is plausible, but the skill's actual footprint is larger than necessary because it relies on a remotely downloaded executable script and asks the agent to expose a blockchain private key for payment. The data flow to fittings.sh matches the stated service, but install trust and credential-forwarding risks are substantial and disproportionate for a simple geocode helper.

Confidence: 86%Severity: 82%
Audit Metadata
Analyzed At
Aug 18, 2026, 05:17 AM
Package URL
pkg:socket/skills-sh/fittings-sh%2Fskills%2Fgeo-forward-geocode%2F@3395b1775cd93824cebb8e414936f3fbcbbdf79bf165fb75c03b34537aa5603f