fittings-crossref-doi-metadata
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches catalog information and a helper script from the vendor's domain.
- Evidence:
curl -s https://fittings.sh/catalog/crossref.doi-metadataandcurl -sO https://fittings.sh/skill/call.mjsin SKILL.md. - [REMOTE_CODE_EXECUTION]: The skill downloads an external JavaScript file (
call.mjs) from the vendor's infrastructure and instructs the agent to execute it. - Evidence:
curl -sO https://fittings.sh/skill/call.mjsfollowed bynode call.mjsin SKILL.md. - [COMMAND_EXECUTION]: The instructions involve executing shell commands to interact with the API and run the downloaded script.
- Evidence: Use of
curl,jq, andnodecommands in the 'Calling it' section of SKILL.md. - [CREDENTIALS_UNSAFE]: The skill requires the user to provide a blockchain private key via an environment variable (
FITTINGS_PRIVATE_KEY) to authorize payments for API calls. - Evidence:
export FITTINGS_PRIVATE_KEY=0x...in SKILL.md. The documentation explicitly warns users to use a throwaway wallet for this purpose.
Audit Metadata