fittings-govinfo-public-law
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a JavaScript helper script (
call.mjs) from the author's domainfittings.shto facilitate API requests. - [COMMAND_EXECUTION]: Executes the downloaded script using
nodeto perform the law lookup and handle payment logic. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it retrieves legal text from an external API for the agent to process. Ingestion points:
fittings.sh/v1/govinfo/public-lawoutput. Boundary markers: No specific delimiters are used to contain the fetched text. Capability inventory: Script execution (node), network requests (curl), and sensitive environment variable handling. Sanitization: No sanitization of the fetched legal text is indicated before presentation to the agent.
Audit Metadata