fittings-fx-ecb-timeseries
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download a JavaScript file (
call.mjs) from the vendor's domain (https://fittings.sh/skill/call.mjs) and execute it usingnode. This script is responsible for handling API interactions and payment signing for the financial data service.\n- [EXTERNAL_DOWNLOADS]: An external script is fetched from the provider's server at runtime to facilitate core functionality.\n- [CREDENTIALS_UNSAFE]: The skill documentation requires theFITTINGS_PRIVATE_KEYenvironment variable to be set with a blockchain private key for payment authorization. The documentation explicitly warns that this key will be stored in plaintext in the execution environment, which poses a security risk.\n- [COMMAND_EXECUTION]: The skill relies on shell commands includingcurlfor downloading external resources andnodefor executing the downloaded script.\n- [PROMPT_INJECTION]: The skill processes financial data retrieved from an external API, creating a surface for indirect prompt injection. Evidence chain:\n - Ingestion points: API response from
https://fittings.sh/v1/fx/ecb-timeseries\n - Boundary markers: Absent\n
- Capability inventory: Subprocess execution via
node call.mjsand network access viacurl\n - Sanitization: None specified
Audit Metadata