fittings-net-dns-lookup
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a JavaScript execution client (
call.mjs) from the vendor's official domain athttps://fittings.sh/skill/call.mjs. - [REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute the downloaded
call.mjsscript using Node.js to facilitate DNS lookups and handle payment authorization. - [CREDENTIALS_UNSAFE]: To enable paid DNS queries, the skill requires a crypto wallet private key to be provided via the
FITTINGS_PRIVATE_KEYenvironment variable. The documentation explicitly advises users to use a throwaway wallet with minimal funds for this purpose. - [DATA_EXPOSURE]: The skill processes live DNS records (A, AAAA, MX, etc.) retrieved from external sources. While this is the intended purpose, the agent is notified to evaluate these records for security and deliverability tasks.
Audit Metadata