fittings-health

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses node scripts/call.mjs to execute local scripts that interact with the health data API. This is the primary mechanism for retrieving records like RxNorm identifiers, FDA recalls, and ClinicalTrials.gov data.
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to https://fittings.sh to fetch drug labels, food nutrients, and medical code data. As this is the vendor's primary domain and the stated purpose of the skill, these downloads are expected and functional.
  • [CREDENTIALS_UNSAFE]: The skill utilizes an environment variable FITTINGS_PRIVATE_KEY for handling USDC payments on the Base network. The instructions explicitly direct the agent to never print, commit, or reveal this key in messages to the user, demonstrating a strong security posture regarding secret management.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes large volumes of external data from medical registries (e.g., DailyMed labels, PubMed citations). While this represents a surface for indirect prompt injection, the skill includes specific guidelines for the agent to treat this data as verbatim records and to surface original attribution and caveats to the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 10:33 PM