fittings-calc-worksheet
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download a JavaScript file from a remote server and execute it locally. Evidence:
curl -sO https://fittings.sh/skill/call.mjsand subsequent execution withnode call.mjs. - [CREDENTIALS_UNSAFE]: The skill requires a blockchain private key to be stored in an environment variable, which can be accessed by the downloaded script or other processes. Evidence: Instruction to
export FITTINGS_PRIVATE_KEY=0x...and a warning that the key resides in plaintext. - [EXTERNAL_DOWNLOADS]: The skill fetches configuration and executable code from an external domain. Evidence: Downloads from
https://fittings.sh/catalog/calc.worksheetandhttps://fittings.sh/skill/call.mjs. - [COMMAND_EXECUTION]: The instructions rely on shell commands to interact with the service and manage payments. Evidence: Use of
curl,jq, andnodewithin the provided command-line examples.
Audit Metadata