geo-forward-geocode
Warn
Audited by Socket on Aug 18, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS: the geocoding purpose is plausible, but the skill's actual footprint is larger than necessary because it relies on a remotely downloaded executable script and asks the agent to expose a blockchain private key for payment. The data flow to fittings.sh matches the stated service, but install trust and credential-forwarding risks are substantial and disproportionate for a simple geocode helper.
Confidence: 86%Severity: 82%
Audit Metadata