lunar-moon-times
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructions specify providing a blockchain private key through the FITTINGS_PRIVATE_KEY environment variable. The call.mjs script uses this key to sign payment authorizations for the x402 protocol. The vendor documentation advises using a throwaway wallet as the key is stored in plaintext.
- [EXTERNAL_DOWNLOADS]: The documentation instructs users to download the call.mjs client script from the vendor's domain (fittings.sh) if it is not already present.
- [COMMAND_EXECUTION]: The skill involves the execution of the call.mjs Node.js script, which performs network requests, cryptographic signing, and dynamic imports of external libraries.
- [REMOTE_CODE_EXECUTION]: The script call.mjs dynamically imports external dependencies including @x402/fetch, @x402/evm, and viem at runtime. The documentation also suggests downloading and running code via curl.
Audit Metadata