fittings-census-geography-bundle
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions involve downloading a JavaScript file (
call.mjs) from the vendor's domain athttps://fittings.sh/skill/call.mjs.- [REMOTE_CODE_EXECUTION]: The skill directs the agent to execute the downloadedcall.mjsscript usingnodeto interact with the Census API.- [CREDENTIALS_UNSAFE]: The skill requires a private key (FITTINGS_PRIVATE_KEY) to be provided as an environment variable for transaction signing. The documentation explicitly states that this key is stored in plaintext within the execution environment.- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from thehttps://fittings.sh/v1/census/geography-bundleendpoint, creating a surface for potential instruction injection through remote data. - Ingestion points: Remote API responses from
fittings.sh. - Boundary markers: No delimiters or ignore instructions are present for the ingested data.
- Capability inventory: The skill utilizes shell execution capabilities (
curl,node). - Sanitization: No evidence of data sanitization or validation was found.
Audit Metadata