fittings-text-similarity
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a JavaScript execution client (
call.mjs) from the vendor's domainhttps://fittings.sh/skill/call.mjs. - [REMOTE_CODE_EXECUTION]: The skill instructs the environment to execute the dynamically downloaded
call.mjsscript using thenoderuntime to facilitate API calls and payment processing. - [CREDENTIALS_UNSAFE]: The skill utilizes a private key for processing payments, passed via the
FITTINGS_PRIVATE_KEYenvironment variable. Although the documentation advises using a throwaway wallet, handling cryptographic private keys in plaintext environment variables presents a risk of credential exposure. - [COMMAND_EXECUTION]: The instructions involve the use of
curlfor fetching remote resources andnodefor executing downloaded code.
Audit Metadata