nws-current-conditions
Warn
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires the user to provide a raw Ethereum private key via the
FITTINGS_PRIVATE_KEYenvironment variable. While the documentation advises using a throwaway wallet, storing private keys in plaintext environment variables is a high-risk practice for secret management. - [EXTERNAL_DOWNLOADS]: The documentation instructs the user to download the primary execution script
call.mjsfrom an external URL (https://fittings.sh/skill/call.mjs). - [COMMAND_EXECUTION]: The skill relies on the execution of the
call.mjsscript, which manages network requests, cryptographic signing of transactions, and dynamic loading of external libraries. - [REMOTE_CODE_EXECUTION]: The
call.mjsscript performs an integrity check by fetching a hash fromhttps://fittings.sh/skill/call.mjs.sha256. If the local script hash does not match the remote hash, it prompts the user to re-download and execute the new version of the script, creating a mechanism for remote code updates controlled by the vendor's server.
Audit Metadata