fittings-solar-sun-position
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to download a JavaScript file from
https://fittings.sh/skill/call.mjsand execute it usingnode. This pattern involves running remote code that is not bundled with the skill itself. - [CREDENTIALS_UNSAFE]: The documentation requires the user or agent to export an Ethereum private key into the
FITTINGS_PRIVATE_KEYenvironment variable to authorize payments. While the skill advises using a throwaway wallet, handling raw private keys within the agent's environment is a sensitive operation. - [EXTERNAL_DOWNLOADS]: The skill performs multiple network requests to
fittings.shto retrieve service catalogs and the execution client, making its functionality dependent on external resources. - [COMMAND_EXECUTION]: The skill utilizes shell commands (
curl,node,export) to manage the installation and execution of its payment-handling client.
Audit Metadata