nhtsa-vin-decode
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The helper script
call.mjsreads theFITTINGS_PRIVATE_KEYenvironment variable to sign payment authorizations for API requests. This is a documented requirement for processing transactions on the x402 protocol. - [EXTERNAL_DOWNLOADS]: The documentation provides instructions to manually download a support script from the vendor's official domain (
https://fittings.sh/skill/call.mjs) if it is not present in the local environment. - [SAFE]: The skill implements an integrity verification process that fetches a remote hash from the vendor's server to compare against the local script. This prevents the use of outdated or potentially incompatible logic when signing financial transactions.
Audit Metadata