fittings-cpsc-recall-check
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation provides instructions to download a script via
curl -sO https://fittings.sh/skill/call.mjsand execute it immediately withnode call.mjs. This pattern allows the vendor to deliver and run arbitrary code on the host machine at runtime. - [EXTERNAL_DOWNLOADS]: The skill retrieves an executable file from a remote server (
fittings.sh). While this domain is identified as the author's own infrastructure, fetching and running remote code is an inherently sensitive operation. - [CREDENTIALS_UNSAFE]: The documentation instructs the user to provide a
FITTINGS_PRIVATE_KEYin plaintext within the environment. This key is used to sign transactions for payments. While the documentation provides a placeholder, the practice of placing sensitive private keys in environment variables where an agent or subprocess can access them carries risk. - [COMMAND_EXECUTION]: The skill relies on shell commands (
curl,jq,node) to perform its primary functions, including metadata retrieval and payment processing.
Audit Metadata