fittings-hts-lookup
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions prompt the agent to download a client script from the vendor-owned domain at https://fittings.sh/skill/call.mjs.
- [REMOTE_CODE_EXECUTION]: The skill directs the agent to execute the downloaded JavaScript file using the Node.js runtime. This creates a risk as the code being executed is hosted externally and could be changed by the vendor without notice.
- [CREDENTIALS_UNSAFE]: The skill requires a blockchain private key (FITTINGS_PRIVATE_KEY) to be provided as an environment variable to pay for API access. Private keys are highly sensitive credentials, and their presence in the environment in plaintext poses a risk of unauthorized fund access, even though the vendor suggests using a throwaway wallet.
Audit Metadata