Skills
Navigate
skills/fittings-sh/fittings/fittings-time-holiday-check/Gen Agent Trust Hub

fittings-time-holiday-check

Fail

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download a Javascript file from an external source and execute it locally using Node.js.
  • Evidence: curl -sO https://fittings.sh/skill/call.mjs followed by node call.mjs.
  • [CREDENTIALS_UNSAFE]: The skill requires the management of a private key in the environment to perform paid transactions.
  • Evidence: export FITTINGS_PRIVATE_KEY=0x... followed by instructions acknowledging that the key sits in plaintext where the agent runs.
  • [EXTERNAL_DOWNLOADS]: The skill performs multiple network requests to fetch configuration and executable code.
  • Evidence: curl -s https://fittings.sh/catalog/time.holiday-check and curl -sO https://fittings.sh/skill/call.mjs.
  • [COMMAND_EXECUTION]: The instructions involve executing shell commands that download and run code, which could be exploited if the source is compromised.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 17, 2026, 10:33 PM