lang-bcp47
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION]: The skill ingests data from a remote API (fittings.sh) to validate language tags and incorporates the response into the agent's context without sanitization. This establishes an attack surface for indirect prompt injection if the remote source is compromised.\n
- Ingestion points: The call.mjs script performs network requests to https://fittings.sh/v1/lang/bcp47 and catalog endpoints to retrieve parsing results and service metadata.\n
- Boundary markers: No delimiters or safety instructions are used to distinguish external API data from the agent's internal instructions.\n
- Capability inventory: The execution environment has network access, blockchain transaction signing capabilities (via viem), and shell command execution permissions.\n
- Sanitization: API responses are parsed as JSON and printed directly to the output without filtering or escaping of potential instructions.\n- [EXTERNAL_DOWNLOADS]: The skill instructions suggest downloading a helper script (call.mjs) from the vendor's domain (fittings.sh). While this is a vendor-owned resource necessary for the skill's payment functionality, it involves remote code acquisition.\n- [COMMAND_EXECUTION]: The skill relies on shell commands, specifically curl for data retrieval and node to execute the local payment helper script.\n- [CREDENTIALS_UNSAFE]: The skill processes blockchain private keys via the FITTINGS_PRIVATE_KEY environment variable. Although the documentation includes warnings to use throwaway wallets, managing raw private keys in an environment accessible to an AI agent poses a risk of credential exposure.
Audit Metadata