Skills
Navigate
skills/fittings-sh/fittings/fittings-time-public-holidays/Gen Agent Trust Hub

fittings-time-public-holidays

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses curl to fetch call.mjs from https://fittings.sh/skill/call.mjs. This is a vendor-owned resource used for API interaction.\n- [REMOTE_CODE_EXECUTION]: The agent is instructed to execute the downloaded call.mjs script using node. This script facilitates the signed payment flow required by the API.\n- [COMMAND_EXECUTION]: The skill requires the execution of shell commands to interact with the service catalog and call the holiday endpoint.\n- [PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection via shell command parameters.\n
  • Ingestion points: The countryCode and year parameters within the node call.mjs execution instructions in SKILL.md.\n
  • Boundary markers: None present; the instructions do not include delimiters or warnings to ignore embedded instructions in data.\n
  • Capability inventory: The skill has the capability to download files (curl), execute local scripts (node), and access environment variables.\n
  • Sanitization: No explicit sanitization, validation, or escaping of input parameters is described or implemented.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 10:33 PM