fittings-lei-search
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation includes a command to fetch the execution script directly from the vendor's domain (
https://fittings.sh/skill/call.mjs).- [CREDENTIALS_UNSAFE]: The execution script relies on a private key provided via theFITTINGS_PRIVATE_KEYenvironment variable. The skill documentation explicitly flags this as sensitive and recommends using a dedicated throwaway wallet to mitigate risks associated with plaintext key storage.- [COMMAND_EXECUTION]: Thecall.mjsscript executes network requests and cryptographic signing operations based on user-provided command-line arguments to interact with the LEI search service.- [REMOTE_CODE_EXECUTION]: The script dynamically imports the@x402/fetchandviempackages to handle the payment protocol. It also includes a version-matching check that fetches a remote hash from the vendor's server to ensure the local script version is compatible with the gateway.
Audit Metadata