cpi-adjust
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation encourages fetching an external script and relies on third-party library dependencies.
- Evidence: SKILL.md suggests downloading the client script via
curl -sO https://fittings.sh/skill/call.mjsif not already present. - Evidence: The provided
call.mjsscript requires the installation of@x402/fetch,@x402/evm, andviempackages from the NPM registry. - [REMOTE_CODE_EXECUTION]: The execution model involves running code sourced from a remote vendor and performing dynamic imports.
- Evidence: The skill instructs the agent to execute the
call.mjsscript usingnode. - Evidence: The
call.mjsscript usesawait import()to dynamically load cryptographic and networking libraries at runtime. - [COMMAND_EXECUTION]: The skill provides explicit shell instructions for the agent to execute in the local environment.
- Evidence: Example commands include performing a catalog lookup with
curl -s https://fittings.sh/catalog/cpi.adjust | jq. - Evidence: The skill involves running
node call.mjswith user-supplied arguments to perform the primary adjustment task.
Audit Metadata