gov-congress-bill
Warn
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires a blockchain private key to be provided via the
FITTINGS_PRIVATE_KEYenvironment variable. This key is used to sign payment authorizations for API access. While the documentation provides a security warning to use a throwaway wallet, storing private keys in environment variables presents a risk of exposure in the local execution environment. - [EXTERNAL_DOWNLOADS]: The documentation instructs users to download the client execution script
call.mjsdirectly from the vendor's domain (https://fittings.sh/skill/call.mjs) usingcurlif it is not already present. - [COMMAND_EXECUTION]: The client script
call.mjsperforms an integrity check by fetching a hash fromhttps://fittings.sh/skill/call.mjs.sha256and comparing it against its own source code to ensure the signing logic matches the gateway's expectations. - [REMOTE_CODE_EXECUTION]: The skill utilizes dynamic runtime imports to load several external dependencies, including
@x402/fetch,@x402/evm, andviem, which are necessary for the blockchain-based payment handshake.
Audit Metadata