fittings-usda-food-search
Fail
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The instructions require the user to export a raw private key (
FITTINGS_PRIVATE_KEY) to the environment. Storing cryptographic private keys in plaintext environment variables is a high-risk practice that exposes sensitive assets. While the skill suggests using a 'throwaway' wallet, the handling of the secret remains inherently unsafe. - [REMOTE_CODE_EXECUTION]: The skill downloads a Javascript file
call.mjsfromhttps://fittings.sh/skill/call.mjsand executes it directly usingnode. This pattern allows the remote server to control local code execution. - [EXTERNAL_DOWNLOADS]: Fetches executable code from an external domain (
fittings.sh) during the payment and invocation process. - [COMMAND_EXECUTION]: The documentation provides shell commands for the agent or user to execute, involving downloading files with
curland running them withnode.
Recommendations
- AI detected serious security threats
Audit Metadata