fittings-nasa-astronomy-picture
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to download a JavaScript file (
call.mjs) and execute it using thenoderuntime. This pattern involves the execution of code fetched directly from a remote network location. - [EXTERNAL_DOWNLOADS]: The skill fetches executable code from the vendor's domain (
https://fittings.sh/skill/call.mjs). While the source belongs to the skill author, this establishes a dependency on remote, non-static code. - [CREDENTIALS_UNSAFE]: The documentation encourages the user to export a private key (
FITTINGS_PRIVATE_KEY) as a plaintext environment variable. This practice exposes sensitive cryptographic material to the local process environment, which can be vulnerable to logging or unauthorized access. - [COMMAND_EXECUTION]: The skill requires the use of shell commands such as
curlandnodeto download resources and run the payment-settlement client. - [PROMPT_INJECTION]: The skill ingests data from the NASA Astronomy Picture of the Day API (specifically the 'explanation' text) into the agent's context. This untrusted external data is processed without explicit boundary markers or sanitization, creating a surface for indirect prompt injection.
Audit Metadata