fittings-weather-nws-point-forecast
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to fetch a JavaScript file from
https://fittings.sh/skill/call.mjsusingcurl. - [REMOTE_CODE_EXECUTION]: The skill specifies executing the downloaded
call.mjsfile via thenoderuntime to facilitate API requests. - [COMMAND_EXECUTION]: The skill uses shell commands including
curl,jq, andnodeto interact with remote services and process data. - [CREDENTIALS_UNSAFE]: The documentation instructs users to export a blockchain private key (
FITTINGS_PRIVATE_KEY) as a plaintext environment variable. This practice exposes sensitive wallet credentials to the process environment. - [PROMPT_INJECTION]: The skill ingests external data from the National Weather Service, creating a surface for indirect prompt injection. Ingestion points: Forecast periods and active alerts from the
nws-point-forecastAPI. Boundary markers: Absent. Capability inventory: Remote code execution (node) and file downloads (curl). Sanitization: No validation or sanitization of the external weather data is implemented.
Audit Metadata