fittings-pkg-name-check
Fail
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download a script from 'https://fittings.sh/skill/call.mjs'.
- [REMOTE_CODE_EXECUTION]: The downloaded 'call.mjs' script is executed using 'node', which allows for the execution of code not verified during the skill's audit.
- [CREDENTIALS_UNSAFE]: The skill requires a cryptocurrency private key to be set in the 'FITTINGS_PRIVATE_KEY' environment variable, creating a high risk of credential theft or exposure.
- [COMMAND_EXECUTION]: The skill uses command-line tools ('curl', 'node') to perform its operations, which increases the risk of command injection or unauthorized system changes.
Recommendations
- AI detected serious security threats
Audit Metadata