fittings-naics-lookup
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download a JavaScript file (
call.mjs) directly fromhttps://fittings.sh/skill/call.mjs. While this domain is associated with the skill's author, downloading code via curl to the local filesystem is a high-risk delivery method. - [REMOTE_CODE_EXECUTION]: The instructions direct the user to execute the downloaded script using
node call.mjs. This grants the remote script full execution privileges in the user's environment. - [CREDENTIALS_UNSAFE]: The skill requires the user to set an environment variable
FITTINGS_PRIVATE_KEYwith an EVM private key to authorize payments. Although the documentation advises using a 'throwaway wallet', storing private keys in environment variables or shell history is a high-risk practice as they may be exposed to other processes or logged to disk.
Audit Metadata