fittings-treasury-reporting-rate
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download an unversioned JavaScript file (
call.mjs) from a remote URL and execute it locally using Node.js. This execution pattern allows the remote server to change the logic being executed at runtime, which is a significant security surface when combined with the use of private keys.\n- [EXTERNAL_DOWNLOADS]: The skill performs network requests tofittings.shto fetch both API metadata and the client execution script.\n- [COMMAND_EXECUTION]: The skill utilizes shell commands (curlandnode) to manage external resources and execute local scripts, including the transmission of sensitive environment variables likeFITTINGS_PRIVATE_KEYto the executed process.
Audit Metadata