fittings-lei-lookup
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a client script (
call.mjs) from the vendor's domain athttps://fittings.sh/skill/call.mjsusingcurl. - [REMOTE_CODE_EXECUTION]: The instructions direct the agent to execute the downloaded
call.mjsscript usingnodeto perform entity lookups. This is the intended delivery mechanism for the skill's functionality. - [COMMAND_EXECUTION]: The skill uses
curlandjqto fetch and parse catalog data fromhttps://fittings.sh/catalog/lei.lookup. - [CREDENTIALS_UNSAFE]: The skill involves setting the
FITTINGS_PRIVATE_KEYenvironment variable to authorize payments for API calls. The documentation explicitly advises the use of a throwaway wallet with minimal funds to mitigate risk, noting that keys are stored in plaintext in the execution environment.
Audit Metadata