epa-carbon-estimate
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the helper script
call.mjsand its SHA256 integrity hash directly from the vendor's official domainfittings.sh. It also relies on standard Node.js packages for blockchain interaction and network requests. - [CREDENTIALS_UNSAFE]: The skill instructions describe setting a
FITTINGS_PRIVATE_KEYenvironment variable to facilitate blockchain-based micropayments. This is a design requirement of the x402 protocol, and the skill provides explicit warnings to use a throwaway wallet to manage risk. - [COMMAND_EXECUTION]: A Node.js script (
call.mjs) is used to process user inputs and perform signed API requests. The script implements an integrity check that compares its own hash against the vendor's gateway to prevent the execution of stale or modified logic. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied activity parameters (fuel type, mode, quantity). The
call.mjsscript provides a layer of sanitization by performing type coercion (number, boolean, JSON) on all arguments before they are included in the API request.
Audit Metadata