fda-drug-recall
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation recommends downloading the
call.mjsscript from the vendor's official domain (fittings.sh). - [COMMAND_EXECUTION]: The skill requires executing the
call.mjsscript with Node.js to facilitate API requests and payment processing. - [CREDENTIALS_UNSAFE]: The skill utilizes an environment variable (
FITTINGS_PRIVATE_KEY) to store a wallet private key required for the x402 payment protocol. The documentation provides a safety warning to use throwaway wallets. - [REMOTE_CODE_EXECUTION]: The
call.mjsscript dynamically loads external dependencies (@x402/fetch,@x402/evm,viem) to handle cryptographic signatures and blockchain communication. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the external openFDA API. While this introduces a potential surface for indirect injection if the API returns malicious content, the source is a trusted government entity.
Audit Metadata