fittings-url-expand
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a JavaScript client file from the vendor domain at https://fittings.sh/skill/call.mjs.
- [REMOTE_CODE_EXECUTION]: The instructions require running the downloaded script with the node runtime to handle metered API payments and requests.
- [PROMPT_INJECTION]: Fetching and expanding external URLs introduces a vector for indirect prompt injection. 1. Ingestion points: url parameter in SKILL.md. 2. Boundary markers: None identified. 3. Capability inventory: Network access and local script execution. 4. Sanitization: No sanitization of the expanded destination content is mentioned.
Audit Metadata