fittings-cve-search
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads an external JavaScript client file (
call.mjs) from the vendor's official domain athttps://fittings.sh/skill/call.mjs. - [REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute the downloaded
call.mjsscript using Node.js to perform API search requests and handle transaction settlement. - [CREDENTIALS_UNSAFE]: The skill utilizes a crypto private key stored in the
FITTINGS_PRIVATE_KEYenvironment variable. The documentation includes security best practices, such as using a throwaway wallet and acknowledging the risks of plaintext key storage. - [INDIRECT_PROMPT_INJECTION]: The skill processes external vulnerability data from the NVD API via a gateway. Ingestion points: Vulnerability descriptions and classifications from the NVD API response enter the agent context. Boundary markers: No explicit delimiters or instructions to ignore embedded content are provided. Capability inventory: The skill environment allows shell command execution via
curlandnode. Sanitization: The skill does not explicitly define sanitization or filtering for the external API content.
Audit Metadata