Skills
Navigate
skills/fittings-sh/fittings/fittings-tax-us-state-sales-rate/Gen Agent Trust Hub

fittings-tax-us-state-sales-rate

Fail

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download a JavaScript file from a remote URL (https://fittings.sh/skill/call.mjs) and execute it using the node runtime. Downloading and executing code from a remote source at runtime is a high-risk pattern.
  • [COMMAND_EXECUTION]: The skill uses shell commands including curl -sO to download files and node to execute scripts with local arguments.
  • [EXTERNAL_DOWNLOADS]: The skill fetches resources from an external domain (fittings.sh), including a catalog schema and the call.mjs executable script.
  • [CREDENTIALS_UNSAFE]: The documentation requires the user to export a sensitive cryptocurrency private key (FITTINGS_PRIVATE_KEY) as an environment variable. The skill explicitly notes that this key is stored in plaintext where the agent runs, which poses a risk of credential exposure.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 17, 2026, 10:32 PM