census-geography-bundle
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a Node.js script (
call.mjs) to perform API requests and handle blockchain-based payments. This script is intended to be executed by the agent to fulfill the primary function of the skill. - [EXTERNAL_DOWNLOADS]: The documentation provides instructions to download the
call.mjsscript from the vendor's official domain (fittings.sh). The script also fetches its own SHA256 checksum from the same domain to verify that the local copy is up to date before processing payments. - [CREDENTIALS_UNSAFE]: The skill requires a private key provided via the
FITTINGS_PRIVATE_KEYenvironment variable to sign off-chain payment authorizations. The documentation includes explicit security warnings, advising the use of throwaway wallets and acknowledging that keys are stored in plaintext within the execution environment. - [DATA_EXFILTRATION]: The script communicates with
fittings.shto fetch service schemas, quotes, and data. While it handles sensitive keys, its network operations are restricted to the vendor's API and standard Ethereum RPC providers for the purpose of payment and data retrieval.
Audit Metadata