skills/fittings-sh/skills/cpi-adjust/Gen Agent Trust Hub

cpi-adjust

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation encourages fetching an external script and relies on third-party library dependencies.
  • Evidence: SKILL.md suggests downloading the client script via curl -sO https://fittings.sh/skill/call.mjs if not already present.
  • Evidence: The provided call.mjs script requires the installation of @x402/fetch, @x402/evm, and viem packages from the NPM registry.
  • [REMOTE_CODE_EXECUTION]: The execution model involves running code sourced from a remote vendor and performing dynamic imports.
  • Evidence: The skill instructs the agent to execute the call.mjs script using node.
  • Evidence: The call.mjs script uses await import() to dynamically load cryptographic and networking libraries at runtime.
  • [COMMAND_EXECUTION]: The skill provides explicit shell instructions for the agent to execute in the local environment.
  • Evidence: Example commands include performing a catalog lookup with curl -s https://fittings.sh/catalog/cpi.adjust | jq.
  • Evidence: The skill involves running node call.mjs with user-supplied arguments to perform the primary adjustment task.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 05:16 AM