fittings-fec-candidate-search
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a JavaScript client utility from the vendor's domain at fittings.sh/skill/call.mjs.
- [REMOTE_CODE_EXECUTION]: Instructs the agent to execute the downloaded script using node to interact with the API endpoints.
- [CREDENTIALS_UNSAFE]: Uses the FITTINGS_PRIVATE_KEY environment variable to store a blockchain private key used for payment settlement on the Base network.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting data from the external FEC API via the fittings.sh gateway.
- Ingestion points: Data returned from the fec.candidate-search endpoint.
- Boundary markers: No delimiters or instructions to ignore embedded content are present in the documentation.
- Capability inventory: The skill uses curl for data fetching and node for executing downloaded logic.
- Sanitization: There is no mention of filtering or sanitizing the data received from the external API before it is processed by the agent.
Audit Metadata