fittings-sam-exclusions-check

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download a JavaScript client (call.mjs) directly from the vendor's infrastructure at https://fittings.sh/skill/call.mjs.- [REMOTE_CODE_EXECUTION]: The downloaded script is executed using node to perform API calls and handle payment signing. This is the primary functional mechanism of the skill and originates from the skill author's domain.- [CREDENTIALS_UNSAFE]: The documentation guides the user to provide a private key (FITTINGS_PRIVATE_KEY) via environment variables to authorize blockchain-based payments. The skill includes appropriate security warnings, such as recommending the use of a throwaway wallet and noting the risks of storing keys in plaintext.- [COMMAND_EXECUTION]: The skill utilizes system commands including curl for fetching the client and catalog metadata, and node for executing the payment client.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 10:33 PM