bls-series
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation references downloading a companion script (call.mjs) from the vendor's official website (fittings.sh) to facilitate interactions with the API.
- [COMMAND_EXECUTION]: The utility script performs a self-integrity check by reading its own source code from the file system to generate a SHA-256 hash, which is then compared against the vendor's published hash to verify that the payment-handling logic remains current.
- [SAFE]: The call.mjs script utilizes dynamic import() statements to load necessary dependencies such as viem and @x402 libraries. This is implemented with static module specifiers to handle the presence of required packages at runtime.
- [SAFE]: While the skill uses an environment variable (FITTINGS_PRIVATE_KEY) to manage a wallet private key for signing payments, it includes explicit documentation advising users to utilize throwaway wallets and provides a 'dry run' mode that prevents accidental spending.
Audit Metadata