fmt-xml-to-json
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [SAFE]: The skill performs a specific and disclosed utility function (XML-to-JSON conversion) using the vendor's deterministic API at fittings.sh.
- [EXTERNAL_DOWNLOADS]: The documentation references downloading a supplementary payment helper script (call.mjs) from the vendor's official domain. This script is part of the vendor's ecosystem for handling metered service settlement.
- [DATA_EXFILTRATION]: The skill transmits XML content to the fittings.sh endpoint for processing. This is a functional requirement of the tool. The included script also accesses environment variables for the user's private key and RPC URL to facilitate crypto-payments, which is clearly documented as part of the metered service model.
Audit Metadata