fittings-time-business-days
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download a JavaScript file (call.mjs) from https://fittings.sh/skill/call.mjs and execute it locally using node. This allows the vendor to dynamically update the code executed by the agent.
- [CREDENTIALS_UNSAFE]: The instructions prompt the user to provide a blockchain private key via the FITTINGS_PRIVATE_KEY environment variable. While intended for payment automation, providing raw private keys to executable scripts downloaded at runtime is a significant security risk.
- [EXTERNAL_DOWNLOADS]: The skill performs several curl operations to fetch configuration data and executable scripts from fittings.sh.
- [COMMAND_EXECUTION]: Uses shell commands (curl, node) to interact with external services and run downloaded scripts.
Audit Metadata