fittings-nws-point-metadata
Fail
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation provides instructions to download a JavaScript file from 'https://fittings.sh/skill/call.mjs' and execute it using 'node call.mjs'. This allows a remote source to execute arbitrary code within the host environment.
- [CREDENTIALS_UNSAFE]: The skill encourages users to export the 'FITTINGS_PRIVATE_KEY' environment variable containing a wallet private key. Storing sensitive credentials in plaintext environment variables is a high-risk security practice, as noted by the skill's own warning that the key sits in plaintext wherever the agent runs.
- [EXTERNAL_DOWNLOADS]: The skill fetches both metadata and executable code from the 'fittings.sh' domain, which is controlled by the vendor.
- [COMMAND_EXECUTION]: The skill relies on shell commands including 'curl' and 'node' to perform its primary functions, including the retrieval and execution of external logic.
Recommendations
- AI detected serious security threats
Audit Metadata