crypto-random-bytes
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The instructions suggest downloading a JavaScript client file from the vendor's domain at
https://fittings.sh/skill/call.mjs. - [COMMAND_EXECUTION]: The skill provides shell commands to execute the downloaded code locally via Node.js.
- [CREDENTIALS_UNSAFE]: The service requires a private key for payments, which the user is instructed to store in the
FITTINGS_PRIVATE_KEYenvironment variable. The vendor provides a warning regarding plaintext storage risks. - [REMOTE_CODE_EXECUTION]: The workflow involves fetching and running external code, which allows for remote code execution if the source is compromised.
Audit Metadata