chem-pubchem-compound
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the user to download the primary execution helper script,
call.mjs, from the vendor's domain (https://fittings.sh/skill/call.mjs) if it is not already present. - [CREDENTIALS_UNSAFE]: The skill requires a blockchain private key to be stored in the
FITTINGS_PRIVATE_KEYenvironment variable. This key is used by thecall.mjsscript to sign payment authorizations for API requests. While the author recommends using a dedicated throwaway wallet, this practice involves handling sensitive cryptographic keys in plaintext. - [COMMAND_EXECUTION]: The skill relies on executing a local Node.js script (
call.mjs) to perform its network operations, payment handshakes, and data retrieval. - [TIME_DELAYED_OR_CONDITIONAL_ATTACKS]: The helper script includes an integrity check that fetches a SHA-256 hash from the vendor's server (
https://fittings.sh/skill/call.mjs.sha256) and terminates execution if it does not match the local file, creating a dependency on external state for the script's availability.
Audit Metadata