eia-fuel-price
Warn
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires a raw blockchain private key to be provided in the
FITTINGS_PRIVATE_KEYenvironment variable. The documentation explicitly acknowledges that this high-value credential is stored in plaintext within the execution environment, which represents a significant exposure risk. - [EXTERNAL_DOWNLOADS]: Skill instructions direct the agent to download a JavaScript helper script (
call.mjs) from the vendor's domain (https://fittings.sh/skill/call.mjs) and execute it. While the source is consistent with the skill author, this pattern of remote code acquisition and execution is a high-risk practice. - [COMMAND_EXECUTION]: The skill operates by having the agent execute shell commands to run the
call.mjsscript with user-supplied arguments to interact with the external API. - [DYNAMIC_EXECUTION]: The
call.mjsscript includes logic to hash its own content and verify it against a remote checksum (https://fittings.sh/skill/call.mjs.sha256) at runtime. It blocks execution if a mismatch is detected, effectively enforcing a remote update policy.
Audit Metadata