Skills
Navigate
skills/fittings-sh/fittings/fittings-fmt-xml-to-json/Gen Agent Trust Hub

fittings-fmt-xml-to-json

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes XML input that may originate from untrusted sources, creating a vector for embedded instructions to influence the agent. \n
  • Ingestion points: The xml field in the API request body. \n
  • Boundary markers: None present. \n
  • Capability inventory: Uses curl for network interaction and shell commands. \n
  • Sanitization: No content filtering is mentioned. \n- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The documentation references external vendor resources including a JavaScript file (https://fittings.sh/skill/call.mjs) and npm packages (@x402/core, @x402/evm) for payment processing. \n- [COMMAND_EXECUTION]: The skill uses curl and jq to interact with remote services and process JSON output.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 10:32 PM