fittings-fema-flood-zone
Fail
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to download a JavaScript file (
call.mjs) from the vendor's domain (https://fittings.sh/skill/call.mjs) and execute it locally using Node.js to perform API calls. - [CREDENTIALS_UNSAFE]: The skill documentation requires the user to set a private key (
FITTINGS_PRIVATE_KEY) to a shell environment variable. Storing and using raw private keys in plaintext environment variables is a high-risk practice that exposes sensitive credentials. - [COMMAND_EXECUTION]: The skill relies on shell commands (
curl,node) to fetch external scripts and execute them with user-supplied arguments (e.g.,lat,lon), which could be a vector for command injection if not properly sanitized by the underlying script.
Recommendations
- AI detected serious security threats
Audit Metadata