lei-search
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation includes a command to download the call.mjs utility script directly from the vendor's domain (https://fittings.sh/skill/call.mjs). This is a primary component of the skill's infrastructure and is hosted on the official vendor site.
- [COMMAND_EXECUTION]: The skill employs a Node.js helper script (call.mjs) to manage API requests and cryptographic signatures. The script includes a self-integrity check that verifies its own hash against the vendor's server to ensure it is using the latest payment logic.
- [CREDENTIALS_UNSAFE]: The skill requires a wallet private key for signing payment transactions, which is supplied via an environment variable (FITTINGS_PRIVATE_KEY). The documentation provides appropriate security warnings, advising users to use throwaway wallets and explaining the payment flow to ensure transparency.
- [PROMPT_INJECTION]: The skill acts as a conduit for data from the GLEIF global registry.
- Ingestion points: Data is retrieved from the vendor's API and processed by call.mjs.
- Boundary markers: None explicitly defined in the skill's markdown instructions.
- Capability inventory: The skill has network access and local script execution capabilities.
- Sanitization: Input arguments are parsed and validated against the service's specific schema within the helper script.
Audit Metadata