text-sentiment
Fail
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires a raw EVM private key to be set in the
FITTINGS_PRIVATE_KEYenvironment variable. The documentation acknowledges that the key sits in plaintext where the agent runs, posing a high risk of exposure. - [EXTERNAL_DOWNLOADS]: Instructions in
SKILL.mdsuggest downloading thecall.mjsscript viacurl -sO https://fittings.sh/skill/call.mjs, which bypasses verified package registries and standard security checks. - [COMMAND_EXECUTION]: The skill utilizes a Node.js script (
call.mjs) that interacts with the filesystem, performs network requests, and executes blockchain signature logic using dynamically imported libraries. - [DATA_EXFILTRATION]: The skill transmits user-provided text to an external API endpoint (
https://fittings.sh/v1/text/sentiment) for sentiment analysis. While intended by the skill's design, this is an external data transfer of potentially sensitive user information.
Recommendations
- AI detected serious security threats
Audit Metadata