fittings-validate
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with 'https://fittings.sh', the vendor's official domain, to perform identifier validation and cryptographic functions.
- [COMMAND_EXECUTION]: The skill utilizes a local utility, 'node scripts/call.mjs', to interact with the vendor's services and perform dry runs or live API calls.
- [CREDENTIALS_UNSAFE]: The skill manages a private key stored in the 'FITTINGS_PRIVATE_KEY' environment variable to facilitate blockchain-based payments in USDC. It provides explicit safety instructions to prevent the key from being logged, committed, or exposed to the user.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a processor for untrusted data, such as bank account numbers, barcodes, and arbitrary text for hashing.
- Ingestion points: External data is ingested through service parameters such as 'iban', 'gtin', 'lei', and the 'text' field for cryptographic digests in 'SKILL.md'.
- Boundary markers: The skill notes that arguments are coerced against the service's input schema, though it does not explicitly mention prompt delimiters for the text being processed.
- Capability inventory: The skill possesses network communication capabilities to the vendor's API and local command execution via 'node scripts/call.mjs'.
- Sanitization: The skill performs input normalization (e.g., electronic form normalization for IBANs) and utilizes schema validation for service arguments.
Audit Metadata