net-dns-lookup
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires the
FITTINGS_PRIVATE_KEYenvironment variable to sign payment authorizations for the x402 protocol. The documentation explicitly advises users to use a throwaway wallet holding minimal funds to mitigate the risk of storing a private key in plaintext. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to download a helper script (
call.mjs) from the vendor's official domainfittings.sh. This script is necessary for the payment handshake and performing the DNS lookups. - [COMMAND_EXECUTION]: The tool involves executing a Node.js script that performs network operations, reads its own file content for integrity verification, and dynamically loads cryptographic libraries for transaction signing.
- [INDIRECT_PROMPT_INJECTION]: The skill processes DNS records (such as TXT or MX records) from external domains. While these are informational, an agent consuming this data should treat the contents as untrusted strings, as attackers could embed instructions in public DNS records.
Audit Metadata