naics-lookup
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The SKILL.md documentation provides example
curlandnodecommands for users to interact with the service. These are standard documentation patterns and do not execute automatically without user intervention. - [EXTERNAL_DOWNLOADS]: The skill mentions downloading a helper script
call.mjsviacurlif it is missing. This targets the vendor's own domain (fittings.sh) and is documented as a manual setup step for the user. - [CREDENTIALS_UNSAFE]: The skill uses an environment variable
FITTINGS_PRIVATE_KEYto handle payments. While it involves a private key, the documentation follows best practices by explicitly warning users to use a 'throwaway wallet' and explaining that the key is stored in plaintext where the agent runs, rather than attempting to hide this risk.
Audit Metadata