fittings-lang-bcp47
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include downloading a JavaScript helper file from the vendor's domain at
https://fittings.sh/skill/call.mjsusingcurl. - [REMOTE_CODE_EXECUTION]: The downloaded
call.mjsscript is executed locally using thenoderuntime to facilitate API requests and payment settlement. - [CREDENTIALS_UNSAFE]: The skill requires the use of a
FITTINGS_PRIVATE_KEYenvironment variable to sign payment authorizations. The author provides explicit security guidance, advising users to use a throwaway wallet holding minimal funds. - [COMMAND_EXECUTION]: The skill utilizes shell commands (
curl,node,jq) to interact with the catalog and execute the payment-enabled client.
Audit Metadata