calc-evaluate
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions guide the user to download a helper script (
call.mjs) from the vendor's official domain (fittings.sh) to facilitate interaction with the evaluation service. - [COMMAND_EXECUTION]: The skill requires running the downloaded Node.js script to perform calls to the evaluator API. The script includes logic to read its own file content and compare its hash against a remote value (
https://fittings.sh/skill/call.mjs.sha256) to ensure it is up to date and has not been tampered with. - [REMOTE_CODE_EXECUTION]: The skill's primary execution flow involving
curl -sOfollowed bynode call.mjsis a remote code execution pattern. This is an intended and documented part of the vendor's payment client implementation for the x402 protocol.
Audit Metadata