fittings-sam-exclusions-check
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download a JavaScript client (
call.mjs) directly from the vendor's infrastructure athttps://fittings.sh/skill/call.mjs.- [REMOTE_CODE_EXECUTION]: The downloaded script is executed usingnodeto perform API calls and handle payment signing. This is the primary functional mechanism of the skill and originates from the skill author's domain.- [CREDENTIALS_UNSAFE]: The documentation guides the user to provide a private key (FITTINGS_PRIVATE_KEY) via environment variables to authorize blockchain-based payments. The skill includes appropriate security warnings, such as recommending the use of a throwaway wallet and noting the risks of storing keys in plaintext.- [COMMAND_EXECUTION]: The skill utilizes system commands includingcurlfor fetching the client and catalog metadata, andnodefor executing the payment client.
Audit Metadata