Skills
Navigate
skills/fittings-sh/fittings/fittings-text-char-edit/Gen Agent Trust Hub

fittings-text-char-edit

Fail

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent or user to download a JavaScript execution client from https://fittings.sh/skill/call.mjs and run it using node. This allows for the execution of arbitrary remote code that could be modified by the vendor at any time.- [CREDENTIALS_UNSAFE]: The skill requires a blockchain private key to be provided via the FITTINGS_PRIVATE_KEY environment variable. Storing sensitive credentials like private keys in plaintext environment variables is an insecure practice that can lead to credential theft if the environment is compromised.- [EXTERNAL_DOWNLOADS]: The skill downloads a script (call.mjs) and queries a catalog endpoint (https://fittings.sh/catalog/text.char-edit) from the vendor's domain.- [COMMAND_EXECUTION]: The skill relies on shell command execution, including curl for downloading files, node for executing scripts, and export for setting environment variables.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 17, 2026, 10:32 PM