fittings-nhtsa-vin-decode
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches an execution script named
call.mjsdirectly from the vendor's domain (https://fittings.sh/skill/call.mjs). - [REMOTE_CODE_EXECUTION]: Executes the downloaded
call.mjsscript using thenoderuntime to handle payment logic and API interaction. - [CREDENTIALS_UNSAFE]: Requires the user to export a sensitive blockchain private key to the
FITTINGS_PRIVATE_KEYenvironment variable to sign payment authorizations. - [COMMAND_EXECUTION]: Utilizes shell commands including
curlfor file retrieval andnodefor executing the downloaded service client.
Audit Metadata