fittings-qr-encode
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill fetches a JavaScript file from https://fittings.sh/skill/call.mjs and runs it with node, enabling the execution of remote code that is not part of the skill's static files.
- [CREDENTIALS_UNSAFE]: The documentation instructs users to set a sensitive blockchain private key in the FITTINGS_PRIVATE_KEY environment variable, which is a plaintext storage method prone to exposure.
- [EXTERNAL_DOWNLOADS]: The skill utilizes curl to retrieve scripts and metadata from the fittings.sh domain, creating a runtime dependency on external resources.
- [COMMAND_EXECUTION]: The skill uses shell commands including curl and node to download and run external scripts, as well as jq for processing catalog data.
Audit Metadata