lei-lookup
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
SKILL.mdfile provides instructions to execute shell commands usingnodeandcurl. Specifically, it instructs users to runnode call.mjsto interact with the service. This is the primary intended function of the skill to facilitate API interaction. - [EXTERNAL_DOWNLOADS]: The skill mentions downloading a helper script using
curl -sO https://fittings.sh/skill/call.mjsif the local copy is missing. It also fetches configuration and quote data fromhttps://fittings.sh/catalog/lei.lookupandhttps://fittings.sh/skill/call.mjs.sha256. These resources are hosted by the vendor (fittings.sh) and are used for operational consistency and payment quoting. - [CREDENTIALS_SAFE]: The skill uses an environment variable
FITTINGS_PRIVATE_KEYto sign payment authorizations for API calls. The documentation explicitly advises users to use a throwaway wallet with minimal funds and warns that the key is stored in plaintext in the environment, demonstrating transparent risk communication regarding secret management.
Audit Metadata