fittings-vat-eu-validate
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation provides instructions to download a JavaScript client (
call.mjs) fromhttps://fittings.sh/skill/call.mjs. This file is hosted on the developer's own infrastructure. - [COMMAND_EXECUTION]: The skill utilizes shell commands (
curl,node) to fetch and run the validation client. It also uses environment variables (FITTINGS_PRIVATE_KEY) to manage authentication for paid API calls. - [REMOTE_CODE_EXECUTION]: The workflow involves downloading a remote script and executing it locally using Node.js. The source of the script matches the vendor's domain (
fittings.sh). - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles a private key for cryptocurrency payments (USDC on Base). The documentation explicitly recommends the use of a throwaway wallet to minimize the risk associated with storing keys in the execution environment.
Audit Metadata