orcid-researcher-profile
Warn
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs users to provide a blockchain private key via the
FITTINGS_PRIVATE_KEYenvironment variable to sign payment authorizations. - [EXTERNAL_DOWNLOADS]: The documentation suggests downloading the execution script
call.mjsusingcurl -sO https://fittings.sh/skill/call.mjsif the file is missing from the skill package. - [COMMAND_EXECUTION]: The execution script
call.mjsparses command-line arguments to construct and trigger network requests to thefittings.shAPI. - [DATA_EXFILTRATION]: The skill transmits signatures derived from the user's private key to the external domain
fittings.shto facilitate metered payments for API calls. - [REMOTE_CODE_EXECUTION]: The script
call.mjsuses dynamicimport()calls to load external dependencies and includes logic to verify its own integrity against a remote hash file (/skill/call.mjs.sha256), prompting the user to re-download the script if a mismatch is detected.
Audit Metadata