Skills
Navigate
skills/fittings-sh/fittings/fittings-lunar-moon-times/Gen Agent Trust Hub

fittings-lunar-moon-times

Warn

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to download a JavaScript client using curl -sO https://fittings.sh/skill/call.mjs.- [REMOTE_CODE_EXECUTION]: The instructions direct the execution of the downloaded script using node call.mjs, which constitutes remote code execution.- [CREDENTIALS_UNSAFE]: The skill requires the user to set an environment variable FITTINGS_PRIVATE_KEY with a sensitive crypto wallet private key, which is stored in plaintext.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the external API https://fittings.sh/v1/lunar/moon-times without explicit sanitization or boundary markers, creating a surface for indirect prompt injection.
  • Ingestion points: GET https://fittings.sh/v1/lunar/moon-times
  • Boundary markers: Absent
  • Capability inventory: Shell command execution via node
  • Sanitization: Absent
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 17, 2026, 10:33 PM