usda-food-search
Warn
Audited by Socket on Aug 18, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS: the core food-search purpose is plausible, but the actual footprint is broader than necessary. The skill routes USDA queries through a third-party gateway, requires a blockchain private key for paid use, and asks users to fetch and execute an unpinned remote helper script from the same gateway domain. That combination is disproportionate for a nutrition lookup skill and creates significant supply-chain, credential-forwarding, and payment-authority risk.
Confidence: 91%Severity: 84%
Audit Metadata