fittings-treasury-exchange-rate
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads an execution script (
call.mjs) from the developer's domain (fittings.sh) and runs it locally using Node.js to process the exchange rate requests.\n- [EXTERNAL_DOWNLOADS]: Fetches a JavaScript client script fromhttps://fittings.sh/skill/call.mjsto facilitate API interaction and transaction signing.\n- [COMMAND_EXECUTION]: Utilizes system commands (curlandnode) to download the client and execute queries with user-provided arguments.\n- [INDIRECT_PROMPT_INJECTION]:\n - Ingestion points: Processes user-supplied data for
country,currency, anddateas part of the API request parameters inSKILL.md.\n - Boundary markers: No delimiters or instructions are present to prevent the agent from obeying instructions potentially embedded within these inputs.\n
- Capability inventory: The skill has the capability to execute shell commands (
curl,node) and perform network operations to thefittings.shendpoint.\n - Sanitization: There is no documented sanitization or validation for the inputs before they are passed to the command-line execution script.
Audit Metadata