fittings-geo-elevation
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a JavaScript helper script (
call.mjs) from the vendor's official domain athttps://fittings.sh/skill/call.mjs. This is a standard part of the vendor's integration workflow. - [COMMAND_EXECUTION]: The instructions include steps to run the downloaded helper script using Node.js (
node call.mjs) to interact with the API endpoints. - [DATA_EXPOSURE]: The skill documentation guides users to set the
FITTINGS_PRIVATE_KEYenvironment variable to enable paid elevation requests. The vendor explicitly warns that this key is stored in plaintext and recommends using a dedicated throwaway wallet for this purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external API responses, which represents a potential ingestion point for untrusted content.
- Ingestion points: Data returned from
https://fittings.sh/v1/geo/elevation. - Boundary markers: Not explicitly defined in the documentation.
- Capability inventory: Includes network access via
curland script execution vianode. - Sanitization: The documentation does not specify internal sanitization routines for the API output.
Audit Metadata