fittings-health
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
node scripts/call.mjsto execute local scripts that interact with the health data API. This is the primary mechanism for retrieving records like RxNorm identifiers, FDA recalls, and ClinicalTrials.gov data. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to
https://fittings.shto fetch drug labels, food nutrients, and medical code data. As this is the vendor's primary domain and the stated purpose of the skill, these downloads are expected and functional. - [CREDENTIALS_UNSAFE]: The skill utilizes an environment variable
FITTINGS_PRIVATE_KEYfor handling USDC payments on the Base network. The instructions explicitly direct the agent to never print, commit, or reveal this key in messages to the user, demonstrating a strong security posture regarding secret management. - [INDIRECT_PROMPT_INJECTION]: The skill processes large volumes of external data from medical registries (e.g., DailyMed labels, PubMed citations). While this represents a surface for indirect prompt injection, the skill includes specific guidelines for the agent to treat this data as verbatim records and to surface original attribution and caveats to the user.
Audit Metadata