fittings-time-zone-clock
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include downloading a JavaScript execution client (
call.mjs) directly from the vendor's website athttps://fittings.sh/skill/call.mjs. - [REMOTE_CODE_EXECUTION]: The agent is instructed to run the downloaded script using the Node.js runtime (
node call.mjs), which allows for the execution of arbitrary external code within the agent's environment. - [COMMAND_EXECUTION]: The skill uses shell commands like
curlto fetch the script andnodeto execute it, as well asjqfor processing JSON data. - [CREDENTIALS_UNSAFE]: The documentation asks the user to export a sensitive
FITTINGS_PRIVATE_KEYas an environment variable to facilitate blockchain-based payments (USDC on Base). Hardcoding or exporting private keys into the environment is a high-risk practice for credential exposure.
Audit Metadata