hazard-active-events
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires downloading a Node.js utility script (call.mjs) from the vendor domain fittings.sh. This script is necessary for performing API calls and handling the HTTP 402 payment protocol.
- [COMMAND_EXECUTION]: Instructions describe executing shell commands (node call.mjs) to interact with the API and sign payment quotes.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests information regarding natural hazard events from external API endpoints (ingestion point: fittings.sh/v1/hazard/active-events). While this represents a data ingestion surface, the structured nature of the hazard data and its specific focus on geographical events present a low risk for indirect prompt injection. Boundary markers are absent in the prompt, and the call.mjs script performs minimal sanitization before outputting JSON, but the capability is limited to telemetry retrieval.
Audit Metadata