fittings-govinfo-us-code-section
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a JavaScript client (
call.mjs) from the vendor's official domain athttps://fittings.sh/skill/call.mjs. - [COMMAND_EXECUTION]: The skill executes the downloaded helper script using the
noderuntime to interact with the metered API endpoint. - [CREDENTIALS_UNSAFE]: The skill instructs the user to configure a
FITTINGS_PRIVATE_KEYenvironment variable for transaction signing. The documentation explicitly advises users to employ a throwaway wallet with minimal funds to mitigate the risk of storing keys in plaintext. - [INDIRECT_PROMPT_INJECTION]: The skill processes statutory text retrieved from external government collections via the vendor's gateway.
- Ingestion points: Data is ingested from the
fittings.sh/v1/govinfo/us-code-sectionAPI response. - Boundary markers: None explicitly defined in the documentation.
- Capability inventory: Includes remote file downloading (
curl) and script execution (node). - Sanitization: No specific sanitization or filtering logic is described for the retrieved statutory text.
Audit Metadata