fittings-tsunami-center-bulletins
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include downloading an external JavaScript file (
call.mjs) from the vendor's domainhttps://fittings.sh/skill/call.mjsusingcurl. - [REMOTE_CODE_EXECUTION]: The skill directs the execution of the downloaded script via
node call.mjs, which constitutes remote code execution as the script's content is fetched at runtime from an external server. - [COMMAND_EXECUTION]: The skill utilizes shell commands (
curl,node,export) to interact with the vendor's API and execute the downloaded client script. - [CREDENTIALS_UNSAFE]: The skill instructs the user or agent to export a sensitive private key (
FITTINGS_PRIVATE_KEY) into the environment variables. While it advises using a throwaway wallet, this practice exposes raw cryptographic keys to the operating environment.
Audit Metadata