hazard-active-events

Warn

Audited by Socket on Aug 18, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The core hazard-data purpose is coherent, but the skill’s footprint is broader than a simple NASA data lookup: it fetches an external helper script and can pass a plaintext blockchain private key into that script to authorize payments. Same-domain provenance reduces the chance of outright malware, but the unpinned remote execution plus credential forwarding makes this a high-risk skill.

Confidence: 88%Severity: 84%
Audit Metadata
Analyzed At
Aug 18, 2026, 05:18 AM
Package URL
pkg:socket/skills-sh/fittings-sh%2Fskills%2Fhazard-active-events%2F@7ac8504d1138d185ac71556dcdf3610cd003fb709562de4510b880ebc5f640d6