calc-evaluate

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions guide the user to download a helper script (call.mjs) from the vendor's official domain (fittings.sh) to facilitate interaction with the evaluation service.
  • [COMMAND_EXECUTION]: The skill requires running the downloaded Node.js script to perform calls to the evaluator API. The script includes logic to read its own file content and compare its hash against a remote value (https://fittings.sh/skill/call.mjs.sha256) to ensure it is up to date and has not been tampered with.
  • [REMOTE_CODE_EXECUTION]: The skill's primary execution flow involving curl -sO followed by node call.mjs is a remote code execution pattern. This is an intended and documented part of the vendor's payment client implementation for the x402 protocol.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 05:16 AM