geo-reverse-geocode
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation provides instructions to download the utility script
call.mjsfrom the vendor's official domain (fittings.sh) if it is not already present. - [COMMAND_EXECUTION]: The skill requires the execution of the
node call.mjsscript to perform geocoding lookups and handle the payment handshake. - [CREDENTIALS_UNSAFE]: The skill uses a private key for blockchain transactions provided via the
FITTINGS_PRIVATE_KEYenvironment variable. The documentation includes appropriate warnings to use throwaway wallets due to the storage of the key in plaintext in the environment. - [DYNAMIC_EXECUTION]: The
call.mjsscript uses dynamicimport()statements to load the necessary web3 and payment libraries (@x402/fetch,@x402/evm,viem) only when needed for processing paid calls. It also performs a self-integrity check by reading its own source code and comparing its hash against a remote reference on the vendor's server to ensure the client logic is up to date.
Audit Metadata