fittings-usda-food-nutrients
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads an external script (
call.mjs) from the vendor's website (https://fittings.sh/skill/call.mjs) and executes it usingnode. This script is the required client for interacting with the payment-enabled API. - [CREDENTIALS_UNSAFE]: The instructions require the user to provide an Ethereum-compatible private key via the
FITTINGS_PRIVATE_KEYenvironment variable to authorize payments. While the documentation warns to use a throwaway wallet, this practice exposes sensitive credentials in the execution environment. - [COMMAND_EXECUTION]: The skill utilizes
curl,jq, andnodeto fetch service catalogs and execute the transaction client. - [EXTERNAL_DOWNLOADS]: The skill fetches its execution client and service catalog from
fittings.sh, which is the vendor's primary domain.
Audit Metadata