qr-encode

Warn

Audited by Socket on Aug 18, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The core QR-encoding purpose is coherent, but the skill’s actual footprint is broader: it downloads remote helper code, encourages execution of that code, and can use a blockchain private key to authorize paid calls. Sending potentially sensitive QR payloads to a third-party API is expected for a hosted encoder, but the combination of remote-code execution plus wallet-key use is disproportionate for a simple QR utility.

Confidence: 85%Severity: 81%
Audit Metadata
Analyzed At
Aug 18, 2026, 05:18 AM
Package URL
pkg:socket/skills-sh/fittings-sh%2Fskills%2Fqr-encode%2F@f539ad9a63dfe41285d3f5ddbf9090a9a106a771dfc8705b3f32360f6e85e9db