fittings-pep-wikidata-screen
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a utility script
call.mjsfrom the vendor's official domainhttps://fittings.shto facilitate API interaction. - [REMOTE_CODE_EXECUTION]: The downloaded script is executed via the
noderuntime to facilitate API calls and payment processing. - [COMMAND_EXECUTION]: Utilizes
curl,jq, andnodecommands to perform service lookups and execute the PEP screening functionality. - [CREDENTIALS_UNSAFE]: The skill requires a private key provided through the
FITTINGS_PRIVATE_KEYenvironment variable for transaction signing. It includes specific guidance on using throwaway wallets and setting price caps to mitigate risk. - [PROMPT_INJECTION]: The skill possesses a data ingestion surface for indirect prompt injection.
- Ingestion points: The
nameparameter in thepep.wikidata-screenAPI call. - Boundary markers: None identified in the skill instructions.
- Capability inventory: Subprocess execution via
curlandnode, network operations tofittings.sh, and local environment variable access. - Sanitization: No input validation or sanitization of the name parameter is documented.
Audit Metadata