Skills
Navigate
skills/fittings-sh/fittings/fittings-lang-detect/Gen Agent Trust Hub

fittings-lang-detect

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads a JavaScript helper file call.mjs from the vendor's official domain at https://fittings.sh/skill/call.mjs.
  • [REMOTE_CODE_EXECUTION]: The instructions direct the agent to execute the downloaded call.mjs script using Node.js to facilitate API requests and payment signing.
  • [CREDENTIALS_UNSAFE]: The skill utilizes an environment variable FITTINGS_PRIVATE_KEY for signing blockchain transactions to pay for API usage. The documentation includes explicit warnings regarding the risks of storing keys in plaintext and recommends the use of throwaway wallets.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text through the lang.detect endpoint to identify languages and scripts.
  • Ingestion points: The text field in the POST /v1/lang/detect request.
  • Boundary markers: None provided in the request schema.
  • Capability inventory: Performs outbound network requests to the vendor's API.
  • Sanitization: None identified in the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 10:32 PM