treasury-exchange-rate

Warn

Audited by Socket on Aug 18, 2026

1 alert found:

Anomaly
AnomalyLOW
SKILL.md

SUSPICIOUS: the skill's stated purpose is coherent, but its actual footprint is broader than necessary for public Treasury rate lookup. The main concerns are third-party routing through fittings.sh, a raw downloaded helper script, and forwarding a wallet private key to local payment logic for a simple data service. This looks more like a monetized gateway with nontrivial trust requirements than direct Treasury data access.

Confidence: 85%Severity: 62%
Audit Metadata
Analyzed At
Aug 18, 2026, 05:18 AM
Package URL
pkg:socket/skills-sh/fittings-sh%2Fskills%2Ftreasury-exchange-rate%2F@11672753db6a1d270ff426cb5f0050c21c8b369b5a90ea3abe5ffda17183449d