fittings-nws-point-forecast
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include downloading a helper script directly from the vendor's domain. \n
- Evidence:
curl -sO https://fittings.sh/skill/call.mjsin SKILL.md. - [REMOTE_CODE_EXECUTION]: The skill directs the agent to execute a downloaded JavaScript file using the Node.js runtime. \n
- Evidence:
node call.mjs nws.point-forecast ...in SKILL.md. - [COMMAND_EXECUTION]: Shell commands such as
curlandnodeare used to perform the skill's core functions. - [INDIRECT_PROMPT_INJECTION]: The skill processes weather data fetched from an external API, which serves as an ingestion point for untrusted content. \n
- Ingestion points: GET request to
https://fittings.sh/v1/nws/point-forecast. \n - Boundary markers: None specified. \n
- Capability inventory:
curl,node. \n - Sanitization: Not explicitly documented in the skill instructions.
Audit Metadata