fittings-fema-disaster-declarations
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a JavaScript client file
call.mjsfrom the vendor domainfittings.shusingcurl. - [REMOTE_CODE_EXECUTION]: The skill instructs the user to execute the downloaded
call.mjsscript usingnodeto interact with the FEMA disaster declaration endpoint. - [CREDENTIALS_UNSAFE]: The documentation describes using an environment variable
FITTINGS_PRIVATE_KEYto store a wallet private key for payment authorization. The skill author includes a specific security warning advising the use of a throwaway wallet since the key is stored in plaintext within the environment.
Audit Metadata