skills/hengxuz/erwaapi/erwa-api/Socket

erwa-api

Warn

Audited by Socket on Apr 17, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The stated purpose is coherent for a Web3 data API, but the trust and data-flow model are not proportionate: installation comes from an unverified third-party skill repo, tokens are obtained manually via WeChat, and all authenticated traffic uses insecure HTTP/WS to a bare IP. The biggest risk is credential exposure and interception, not confirmed malware.

Confidence: 90%Severity: 86%

Audit Metadata

Analyzed At

Apr 17, 2026, 11:31 AM

Package URL

pkg:socket/skills-sh/hengxuZ%2FerwaAPI%2Ferwa-api%2F@35ab541d9a16ddf00b62f240569c85b73745b15b