fittings-pdb-structure
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a JavaScript utility (
call.mjs) from the vendor's domain (fittings.sh) to facilitate interaction with their payment-gated API. - [REMOTE_CODE_EXECUTION]: The skill instructs the user to execute the downloaded
call.mjsscript using Node.js to perform API calls and sign transaction quotes. - [COMMAND_EXECUTION]: The documentation includes shell commands using
curlto fetch configuration and scripts, andnodeto execute the transaction facilitator. - [CREDENTIALS_UNSAFE]: The skill requires a blockchain private key to be provided via the
FITTINGS_PRIVATE_KEYenvironment variable for payment authorization. The documentation explicitly advises the use of a throwaway wallet for this purpose to mitigate risk.
Audit Metadata