fittings-water-usgs-streamflow
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions include downloading a remote JavaScript file from a vendor-controlled domain using
curl -sO https://fittings.sh/skill/call.mjsand executing it vianode call.mjs. While this is a vendor-owned resource, it constitutes a remote code execution pattern. - [CREDENTIALS_UNSAFE]: The skill requires the user to provide a sensitive cryptographic private key via the
FITTINGS_PRIVATE_KEYenvironment variable. The documentation notes that this key is stored in plaintext in the execution environment and recommends using a throwaway wallet to mitigate risk. - [EXTERNAL_DOWNLOADS]: The skill performs multiple network requests to
fittings.shto fetch service catalogs (/catalog/water.usgs-streamflow) and the execution client (/skill/call.mjs). - [COMMAND_EXECUTION]: The skill relies on shell command execution for its primary functionality, including
curl,node, and environment variable management.
Audit Metadata