nws-point-metadata
Warn
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructions require the user to set the FITTINGS_PRIVATE_KEY environment variable with a raw Ethereum private key to authorize API payments. The documentation explicitly warns that this key remains in plaintext within the agent's execution environment, posing a risk of exposure if the host is compromised.
- [EXTERNAL_DOWNLOADS]: The skill requires downloading a core execution script, call.mjs, from the vendor's domain (https://fittings.sh/skill/call.mjs). Executing remotely sourced scripts is a common attack vector, even when the source is the stated vendor.
- [COMMAND_EXECUTION]: Operation of the skill involves running a Node.js script that performs dynamic imports and manages network communications. The script includes an automated integrity check that compares a local SHA-256 hash against a remote hash file (https://fittings.sh/skill/call.mjs.sha256), effectively enforcing remote updates.
- [DATA_EXFILTRATION]: The execution script generates and transmits cryptographic signatures based on the user's private key to the fittings.sh gateway to process payment settlements for the service.
Audit Metadata