fittings-sec-company-filings
Fail
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The instructions direct the user to download an external JavaScript file (
call.mjs) fromhttps://fittings.sh/skill/call.mjsand execute it usingnode. This pattern allows the remote server to deliver and execute arbitrary code on the local system. - [CREDENTIALS_UNSAFE]: The skill requires the user to export a raw Ethereum private key (
FITTINGS_PRIVATE_KEY) as an environment variable. Storing highly sensitive cryptographic keys in plaintext within the execution environment is an insecure practice that exposes the user to potential financial loss if the environment or agent is compromised. - [EXTERNAL_DOWNLOADS]: The skill fetches a functional execution script from a remote domain (
fittings.sh) rather than including the source code directly within the skill package or using a verified package manager.
Recommendations
- AI detected serious security threats
Audit Metadata