fittings-energy-uk-carbon-intensity
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a JavaScript client script (
call.mjs) from the vendor's official domain athttps://fittings.sh/skill/call.mjsto facilitate API interactions. - [REMOTE_CODE_EXECUTION]: The downloaded
call.mjsscript is executed locally using Node.js to perform API calls and sign payment authorizations. - [COMMAND_EXECUTION]: The skill provides shell commands for the agent to execute, including
curlfor downloading scripts and checking the service catalog, andnodefor running the payment client. - [CREDENTIALS_UNSAFE]: The instructions describe the use of an environment variable
FITTINGS_PRIVATE_KEYto hold a blockchain private key for payment authorization. The skill includes a specific warning to use a throwaway wallet rather than a main wallet due to the key being stored in plaintext in the environment.
Audit Metadata