energy-uk-carbon-intensity
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill requires a blockchain private key to be set in the FITTINGS_PRIVATE_KEY environment variable. This key is used to sign payment authorizations for the Carbon Intensity API. The skill includes a warning to use a throwaway wallet for security.
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The documentation includes instructions to download the call.mjs script from the vendor's domain using curl as a fallback. This script is necessary for the skill's payment and API interaction logic.
- [COMMAND_EXECUTION]: The skill involves executing shell commands to fetch metadata and run the payment-enabled client script via Node.js.
- [DYNAMIC_EXECUTION]: The call.mjs script utilizes dynamic ES module imports to load libraries such as @x402/fetch, @x402/evm, and viem at runtime to handle cryptographic signing and payment protocol handshakes.
- [INDIRECT_PROMPT_INJECTION]: The skill processes JSON data from the Fittings API catalog and endpoint. Ingestion points: catalog search and service endpoint responses in call.mjs. Boundary markers: absent. Capability inventory: network operations and cryptographic signing. Sanitization: internal JSON parsing and schema-based argument validation in parseArgs.
Audit Metadata