fittings-qr-generate
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Fetches a helper script (call.mjs) from the vendor's domain (fittings.sh) and runs it using the system's Node.js runtime.
- [COMMAND_EXECUTION]: Utilizes curl to download files and node to execute the interface script.
- [EXTERNAL_DOWNLOADS]: Downloads remote resources from fittings.sh, including a JavaScript execution client.
- [PROMPT_INJECTION]: The skill accepts arbitrary string data for QR code generation, which is processed by the agent using capabilities that include file writing and script execution.
- Ingestion points: content parameter in SKILL.md.
- Boundary markers: Absent.
- Capability inventory: File system writing (curl -sO) and local script execution (node call.mjs).
- Sanitization: None described for the input text.
Audit Metadata