ndbc-buoy-conditions
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads
call.mjsfromhttps://fittings.sh/skill/call.mjsusingcurlif the file is missing. This is a vendor-owned resource used for the skill's primary function. - [COMMAND_EXECUTION]: The skill instructs the user to run shell commands involving
curl,jq, andnodeto interact with the service and execute thecall.mjsscript. - [CREDENTIALS_UNSAFE]: The script processes a private key via the
FITTINGS_PRIVATE_KEYenvironment variable. While this is a sensitive operation, the skill follows best practices by providing documentation on using throwaway wallets, enforcing aFITTINGS_MAX_PRICEcap, and requiring a dry-run by default unless the key is explicitly set.
Audit Metadata