civic-record
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local script
scripts/call.mjsto interface with external APIs. This script handles input parsing, request construction, and the signature-based payment handshake. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to the vendor domain
fittings.shto fetch catalog information and record data. It also requires the installation of external Node.js dependencies (@x402/fetch, @x402/evm, viem) for blockchain operations. The script verifies its own integrity by checking a remote hash from the same domain. - [CREDENTIALS_UNSAFE]: The skill utilizes the
FITTINGS_PRIVATE_KEYenvironment variable for transaction signing. It includes explicit guardrails instructing the AI agent to never display or log this key, mitigating the risk of accidental exposure.
Audit Metadata