fittings-geo-distance
Fail
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download an external script from
https://fittings.sh/skill/call.mjsusingcurl. - [REMOTE_CODE_EXECUTION]: The skill provides instructions to execute the downloaded script using
node, creating a 'download and execute' pattern for remote code. - [CREDENTIALS_UNSAFE]: The documentation explicitly instructs the user to provide a sensitive crypto wallet private key via the
FITTINGS_PRIVATE_KEYenvironment variable. While the skill warns users to use a 'throwaway wallet', exposing private keys in environment variables or command history is a high-risk practice. - [COMMAND_EXECUTION]: The skill provides shell commands (
curl,node,export) to be run in the user's environment, which facilitates the execution of external code and the handling of sensitive credentials.
Recommendations
- AI detected serious security threats
Audit Metadata