fittings-nasa-power-point
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads a script from https://fittings.sh/skill/call.mjs and executes it using the node runtime. This creates a dependency on remote code that is executed with the local agent's privileges.
- [CREDENTIALS_UNSAFE]: The documentation directs users to store a blockchain private key in the FITTINGS_PRIVATE_KEY environment variable. The skill author explicitly notes that the key is stored in plaintext, which is a high-risk practice for credential exposure.
- [COMMAND_EXECUTION]: The skill invokes shell commands such as curl and node to download components and execute logic with command-line arguments.
- [EXTERNAL_DOWNLOADS]: The skill retrieves its primary client logic from the vendor's domain at fittings.sh during initialization.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. 1. Ingestion points: User-provided latitude, longitude, start date, and end date. 2. Boundary markers: None. 3. Capability inventory: Shell command execution and environment variable access. 4. Sanitization: No evidence of input validation or escaping before shell interpolation.
Audit Metadata