fittings-text-profanity-filter
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download a script using 'curl -sO https://fittings.sh/skill/call.mjs' and execute it with 'node call.mjs'. This pattern downloads and runs remote code at runtime, which can be risky if the remote source is compromised.
- [CREDENTIALS_UNSAFE]: The skill requires a 'FITTINGS_PRIVATE_KEY' environment variable to handle USDC payments on the Base network. Storing private keys in plaintext environment variables is a high-risk practice as they may be exposed to other processes, captured in logs, or leaked during debugging.
- [EXTERNAL_DOWNLOADS]: The skill fetches executable resources from 'https://fittings.sh'. While this is the vendor's own domain, fetching unversioned executable content at runtime creates a significant attack surface and bypasses traditional software supply chain security checks.
- [COMMAND_EXECUTION]: The instructions involve shell commands ('curl', 'node', 'export') to set up and run the service, which will execute with the full permissions of the agent's environment, creating a potential for lateral movement if the downloaded script is malicious.
Audit Metadata