fittings-road-nearest
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download a JavaScript helper file from the vendor's domain at
https://fittings.sh/skill/call.mjsto facilitate API requests. - [REMOTE_CODE_EXECUTION]: The skill provides instructions to execute the downloaded
call.mjsfile using Node.js to interact with the road segment API and process payments. - [COMMAND_EXECUTION]: The documentation includes shell commands for inspecting the service catalog (
curl ... | jq) and executing the payment client with specific geographic parameters. - [CREDENTIALS_UNSAFE]: The skill guides users to provide a private key (
FITTINGS_PRIVATE_KEY) as an environment variable to authorize USDC payments on the Base network. The documentation explicitly notes the security implications, advising the use of a throwaway wallet for this purpose.
Audit Metadata