aba-routing-validate
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires the user to set a private key in the FITTINGS_PRIVATE_KEY environment variable. Storing keys in plaintext environment variables is a security risk, particularly in shared or automated agent environments.
- [EXTERNAL_DOWNLOADS]: Instructions suggest downloading the call.mjs script from the vendor's domain at https://fittings.sh/skill/call.mjs if it is not already present.
- [COMMAND_EXECUTION]: The skill operates by executing node call.mjs, which runs a local script that performs API requests and cryptographic signing of transactions.
- [DYNAMIC_EXECUTION]: The call.mjs script dynamically imports several payment and blockchain libraries (@x402/fetch, @x402/evm, viem) at runtime based on the service's payment requirements.
Audit Metadata