fittings-kev-status
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a JavaScript client script from
https://fittings.sh/skill/call.mjs. As this resource is hosted on the vendor's own infrastructure (fittings.sh), it is considered part of the service's intended functionality. - [REMOTE_CODE_EXECUTION]: The instructions describe downloading and executing the
call.mjsscript usingnode. This pattern is used to facilitate payment and API interaction through the vendor's client. - [COMMAND_EXECUTION]: The skill utilizes shell commands including
curlfor metadata retrieval andnodefor script execution. - [CREDENTIALS_UNSAFE]: The skill instructions require the user to provide a private key (
FITTINGS_PRIVATE_KEY) for transaction signing. While not hardcoded, handling raw private keys in environment variables is a sensitive operation, which the vendor documents with appropriate warnings.
Audit Metadata