fittings-airport-nearby
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs users to export a private key into the
FITTINGS_PRIVATE_KEYenvironment variable to enable paid API calls. Storing sensitive credentials in environment variables is a high-risk practice as they can be accessed by the agent or other processes in the execution environment.- [EXTERNAL_DOWNLOADS]: The skill fetches a remote JavaScript client fromhttps://fittings.sh/skill/call.mjsusingcurlduring the setup process.- [REMOTE_CODE_EXECUTION]: The skill executes the downloadedcall.mjsfile usingnode. This involves running external code that is not provided in the skill's source files, creating a reliance on the integrity of the vendor's remote server.- [COMMAND_EXECUTION]: The instructions rely on shell commands includingcurl,node, andexportto manage credentials, download dependencies, and execute the payment-enabled client.
Audit Metadata