fittings-nhc-active-cyclones
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a utility script (
call.mjs) directly from the vendor's official domain,https://fittings.sh/skill/call.mjs, to facilitate API interaction. - [REMOTE_CODE_EXECUTION]: The instructions direct the agent or user to execute the downloaded JavaScript file using the
noderuntime. This script handles the complex logic for the x402 payment protocol and API requests. - [COMMAND_EXECUTION]: The skill uses shell commands like
curlto download resources andjqto parse JSON catalog data from the vendor's service. - [CREDENTIALS_UNSAFE]: The skill utilizes an environment variable named
FITTINGS_PRIVATE_KEYfor signing payment authorizations. The documentation includes a security warning, advising users that the key is stored in plaintext and recommending the use of a throwaway wallet holding minimal funds.
Audit Metadata