fx-ecb-rate
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides and utilizes a Node.js script (
call.mjs) to perform API requests and handle the payment handshake required by the service. - [EXTERNAL_DOWNLOADS]: The documentation suggests fetching the
call.mjsclient script directly from the vendor's domain (fittings.sh) if it is not present in the local environment. - [CREDENTIALS_UNSAFE]: The client script uses a private key from the
FITTINGS_PRIVATE_KEYenvironment variable to sign off-chain payment authorizations. While this involves handling sensitive credentials, the skill documentation explicitly warns the user to use throwaway wallets and notes that keys are stored in plaintext.
Audit Metadata