fittings-lei-search

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The documentation includes a command to fetch the execution script directly from the vendor's domain (https://fittings.sh/skill/call.mjs).- [CREDENTIALS_UNSAFE]: The execution script relies on a private key provided via the FITTINGS_PRIVATE_KEY environment variable. The skill documentation explicitly flags this as sensitive and recommends using a dedicated throwaway wallet to mitigate risks associated with plaintext key storage.- [COMMAND_EXECUTION]: The call.mjs script executes network requests and cryptographic signing operations based on user-provided command-line arguments to interact with the LEI search service.- [REMOTE_CODE_EXECUTION]: The script dynamically imports the @x402/fetch and viem packages to handle the payment protocol. It also includes a version-matching check that fetches a remote hash from the vendor's server to ensure the local script version is compatible with the gateway.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 10:32 PM