fittings-sec-company-facts
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a JavaScript execution script (
call.mjs) from the vendor's official domain athttps://fittings.sh/skill/call.mjs. - [REMOTE_CODE_EXECUTION]: The skill executes the downloaded
call.mjsfile usingnodeto process API requests and handle the payment protocol. - [COMMAND_EXECUTION]: The instructions involve executing shell commands such as
curlto fetch configuration and scripts, andnodeto run the client utility. - [CREDENTIALS_UNSAFE]: The skill requires a
FITTINGS_PRIVATE_KEYenvironment variable for processing payments. The documentation includes security guidance advising the use of throwaway wallets and acknowledging that keys are stored in plaintext within the execution environment.
Audit Metadata