fittings-airport-nearby

Warn

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill instructs users to export a private key into the FITTINGS_PRIVATE_KEY environment variable to enable paid API calls. Storing sensitive credentials in environment variables is a high-risk practice as they can be accessed by the agent or other processes in the execution environment.- [EXTERNAL_DOWNLOADS]: The skill fetches a remote JavaScript client from https://fittings.sh/skill/call.mjs using curl during the setup process.- [REMOTE_CODE_EXECUTION]: The skill executes the downloaded call.mjs file using node. This involves running external code that is not provided in the skill's source files, creating a reliance on the integrity of the vendor's remote server.- [COMMAND_EXECUTION]: The instructions rely on shell commands including curl, node, and export to manage credentials, download dependencies, and execute the payment-enabled client.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 17, 2026, 10:31 PM