fittings-fx-ecb-rate
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a JavaScript file from the vendor's domain at https://fittings.sh/skill/call.mjs.
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to execute the downloaded script using node call.mjs, which allows external code from the vendor to run on the local system.
- [CREDENTIALS_UNSAFE]: The documentation advises users to export a wallet private key (FITTINGS_PRIVATE_KEY) as a plaintext environment variable, which can expose sensitive credentials to other processes.
- [COMMAND_EXECUTION]: The skill provides shell commands such as curl and node to manage dependencies and execute code, facilitating the download and execution of external scripts.
Audit Metadata