Skills
Navigate
skills/fittings-sh/skills/csl-name-screen/Gen Agent Trust Hub

csl-name-screen

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to download a helper script and verifies its integrity against the vendor's domain.
  • Evidence: curl -sO https://fittings.sh/skill/call.mjs in SKILL.md and integrity hash retrieval from https://fittings.sh/skill/call.mjs.sha256 in call.mjs.
  • [COMMAND_EXECUTION]: The instructions rely on shell commands to set up and run the screening utility.
  • Evidence: Markdown examples demonstrate using curl for downloads and node call.mjs for execution.
  • [CREDENTIALS_UNSAFE]: The script accesses a private key from the environment to sign payment authorizations for API usage.
  • Evidence: process.env.FITTINGS_PRIVATE_KEY is used in call.mjs to authorize payments via the @x402 libraries.
  • [REMOTE_CODE_EXECUTION]: The helper script includes a mechanism to detect if it is out of date by comparing its own hash to a remote source, facilitating manual updates from the vendor.
  • Evidence: The SHA256 check logic in call.mjs compares local file content against BASE/skill/call.mjs.sha256.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 05:16 AM