text-char-edit
Warn
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires the user to store a blockchain private key in the FITTINGS_PRIVATE_KEY environment variable. As highlighted in the skill's documentation, this key is stored in plaintext within the agent's environment, which poses a significant risk of credential exposure if the system is compromised.\n- [EXTERNAL_DOWNLOADS]: The instructions suggest fetching the call.mjs helper script from the vendor's domain using curl -sO https://fittings.sh/skill/call.mjs. This method involves downloading executable code from an external source without using a verified package manager.\n- [COMMAND_EXECUTION]: The skill uses node call.mjs to execute operations that include signing payment authorizations and making network requests.\n- [DATA_EXFILTRATION]: Text data processed by the tool is sent to an external API endpoint at https://fittings.sh/v1/text/char-edit. Users should be aware that data is transmitted to a third-party service provider.
Audit Metadata