fittings-geo-reverse-geocode
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a JavaScript client script (
call.mjs) from the vendor's official domain athttps://fittings.sh/skill/call.mjs. - [COMMAND_EXECUTION]: The skill executes the downloaded script using the
noderuntime to perform geocoding lookups and handle payments. - [REMOTE_CODE_EXECUTION]: The workflow follows a download-and-execute pattern where remote code is fetched and run locally to interact with the Fittings API.
- [CREDENTIALS_UNSAFE]: The skill requires a private key (
FITTINGS_PRIVATE_KEY) to be provided as an environment variable for authenticating paid transactions. The documentation includes explicit warnings to use a throwaway wallet to mitigate risks associated with plaintext key storage.
Audit Metadata