usda-food-search

Warn

Audited by Socket on Aug 18, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the core food-search purpose is plausible, but the actual footprint is broader than necessary. The skill routes USDA queries through a third-party gateway, requires a blockchain private key for paid use, and asks users to fetch and execute an unpinned remote helper script from the same gateway domain. That combination is disproportionate for a nutrition lookup skill and creates significant supply-chain, credential-forwarding, and payment-authority risk.

Confidence: 91%Severity: 84%
Audit Metadata
Analyzed At
Aug 18, 2026, 05:17 AM
Package URL
pkg:socket/skills-sh/fittings-sh%2Fskills%2Fusda-food-search%2F@e185d337b7ba87eceed3b53fb8979f254ad61c23c3458390249010cd4063b4fb