regulations-document-search
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a helper script, call.mjs, which is fetched from the vendor's domain fittings.sh to perform search operations and manage payments.
- [COMMAND_EXECUTION]: The skill operates by executing a local Node.js script that handles parameter parsing and API communication.
- [REMOTE_CODE_EXECUTION]: The script contains an integrity verification mechanism that hashes its own content and compares it to a remote source at fittings.sh, suggesting a manual re-download if the script is outdated.
- [DATA_EXFILTRATION]: User-provided search terms and transaction signatures are transmitted to the vendor's API at fittings.sh to retrieve document data and settle service fees.
Audit Metadata