Skills
Navigate
skills/fittings-sh/fittings/fittings-ndc-package-lookup/Gen Agent Trust Hub

fittings-ndc-package-lookup

Fail

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to download a JavaScript file from https://fittings.sh/skill/call.mjs and execute it directly using node.
  • Evidence: curl -sO https://fittings.sh/skill/call.mjs followed by node call.mjs ndc.package-lookup ... in SKILL.md.
  • [CREDENTIALS_UNSAFE]: The instructions encourage the agent to set a sensitive private key in a plaintext environment variable.
  • Evidence: export FITTINGS_PRIVATE_KEY=0x... in SKILL.md. The text also explicitly notes that the key sits in plaintext where the agent runs.
  • [EXTERNAL_DOWNLOADS]: The skill fetches code and metadata from an external domain.
  • Evidence: curl -s https://fittings.sh/catalog/ndc.package-lookup and curl -sO https://fittings.sh/skill/call.mjs in SKILL.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from an external API which could potentially contain malicious instructions if the data source is compromised.
  • Ingestion points: GET https://fittings.sh/v1/ndc/package-lookup in SKILL.md.
  • Boundary markers: None identified.
  • Capability inventory: Shell execution via node call.mjs in SKILL.md.
  • Sanitization: None identified.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 17, 2026, 10:31 PM