fittings-email-deliverability
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a JavaScript execution client (call.mjs) from the vendor's domain https://fittings.sh/skill/call.mjs using curl.
- [REMOTE_CODE_EXECUTION]: Executes the downloaded script via node to facilitate API interactions and payment signing.
- [COMMAND_EXECUTION]: Uses shell commands to download files and run scripts, and instructs the setup of the FITTINGS_PRIVATE_KEY environment variable for authentication.
- [PROMPT_INJECTION]: The skill processes user-provided email addresses and passes them as arguments to a command-line tool without documented sanitization, creating a potential injection surface. 1. Ingestion points: email parameter in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: curl, node. 4. Sanitization: None.
Audit Metadata