Skills
Navigate
skills/fittings-sh/fittings/fittings-addr-standardize/Gen Agent Trust Hub

fittings-addr-standardize

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads a helper script (call.mjs) from the vendor's domain (https://fittings.sh/skill/call.mjs).
  • [REMOTE_CODE_EXECUTION]: The instructions describe fetching and executing a utility script from the vendor's domain (https://fittings.sh/skill/call.mjs) using node.
  • [COMMAND_EXECUTION]: The skill uses node to run the call.mjs script with user-supplied address arguments.
  • [PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection through its processing of external address data.
  • Ingestion points: Address strings provided via the address parameter in the SKILL.md usage examples.
  • Boundary markers: Absent. The skill does not employ delimiters or specific instructions to ignore potentially malicious content within the address strings.
  • Capability inventory: The skill environment facilitates network requests via curl and local script execution via node.
  • Sanitization: There are no documented steps for sanitizing or validating the input data before it is processed.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 10:31 PM