fittings-valid-lei
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download a JavaScript client (
call.mjs) from the vendor's domain (https://fittings.sh/skill/call.mjs) and execute it using Node.js at runtime. This practice of fetching and running external code is a significant execution vector, although the source matches the vendor's infrastructure. - [COMMAND_EXECUTION]: The instructions utilize the
curlcommand to fetch remote files and thenodecommand to execute the downloaded JavaScript file, representing a multi-step execution chain initiated by the skill. - [CREDENTIALS_UNSAFE]: The documentation encourages the user to set a wallet private key in the
FITTINGS_PRIVATE_KEYenvironment variable. While the documentation uses a placeholder (0x...), this pattern promotes storing highly sensitive cryptographic secrets in plaintext within the shell environment, which could be exposed to other processes or logged. - [EXTERNAL_DOWNLOADS]: The skill mentions external Node.js dependencies
@x402/coreand@x402/evmas components for building custom clients to interact with the service.
Audit Metadata