nhtsa-safety-ratings
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the execution of a bundled or downloaded Node.js script (
call.mjs) to interact with the API and manage blockchain transactions. - [CREDENTIALS_UNSAFE]: The skill requires the user to expose a blockchain private key through the
FITTINGS_PRIVATE_KEYenvironment variable. The documentation includes a safety warning to use a throwaway wallet because the key resides in plaintext within the execution environment. - [EXTERNAL_DOWNLOADS]: Instructions in
SKILL.mdencourage users to download thecall.mjsexecutable script directly from the vendor's domain (https://fittings.sh/skill/call.mjs) if it is missing. - [REMOTE_CODE_EXECUTION]: The utility script
call.mjsperforms a self-integrity check by fetching a SHA256 hash from a remote server (fittings.sh) and comparing it to its own content, creating a network dependency for script validation.
Audit Metadata