fittings-csl-name-screen
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads an external JavaScript file (
call.mjs) fromhttps://fittings.sh/skill/call.mjs. This file is hosted on the vendor's primary domain and is used to facilitate API calls and payment processing. - [REMOTE_CODE_EXECUTION]: The instructions direct the agent to download a script and execute it locally using Node.js (
node call.mjs). This is a functional requirement for the service's payment gateway logic which is hosted by the vendor. - [COMMAND_EXECUTION]: The skill documentation includes shell commands using
curl,jq, andnodeto interact with the API and the payment client. - [CREDENTIALS_UNSAFE]: The documentation describes using the
FITTINGS_PRIVATE_KEYenvironment variable to authenticate payments. While it encourages the use of a throwaway wallet, users should be aware that environment variables can be exposed in certain execution environments. This is presented as an instruction for setup rather than a hardcoded secret.
Audit Metadata