fittings-sec-filing-search
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a helper script,
call.mjs, from the vendor's domainhttps://fittings.sh/skill/call.mjs. This script is used to facilitate API interactions and handle the x402 payment protocol. - [COMMAND_EXECUTION]: Instructions are provided to execute the downloaded script using
node call.mjs. This execution is used to perform searches and manage payment quotes. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves full-text data from SEC EDGAR filings, which are external sources. Although these are public regulatory filings, the data should be treated as untrusted content when processed by an agent to mitigate risks of indirect injection.
- Ingestion points: Data returned from the
GET /v1/sec/filing-searchendpoint. - Boundary markers: None explicitly defined in the provided instructions.
- Capability inventory: Remote script download and shell execution via Node.js.
- Sanitization: Not explicitly mentioned; standard agent-side sanitization is recommended.
Audit Metadata