fittings-civic
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local script
scripts/call.mjsto query services and handle payments. - [EXTERNAL_DOWNLOADS]: It fetches data from the vendor's domain
https://fittings.shto retrieve information from federal databases. - [CREDENTIALS_UNSAFE]: The skill uses a
FITTINGS_PRIVATE_KEYenvironment variable for transactions; it includes explicit instructions for the agent to protect this secret from exposure. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external government records through
scripts/call.mjs. While it lacks explicit sanitization documentation, the risk is categorized as low given the authoritative nature of the public record sources.
Audit Metadata