ctgov-trial-search
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires a blockchain private key provided via the
FITTINGS_PRIVATE_KEYenvironment variable to sign micropayments. The documentation explicitly notes that the key is stored in plaintext, which is a security risk if the execution environment is not properly secured. - [EXTERNAL_DOWNLOADS]: Instructions are provided to download the
call.mjshelper script from the vendor's domain (https://fittings.sh/skill/call.mjs) if it is not already present. This script is used to facilitate the x402 payment handshake. - [COMMAND_EXECUTION]: The skill relies on the execution of shell commands and a Node.js script to interact with the clinical trials API and manage payment authorizations.
Audit Metadata