noaa-coops-station-data

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the user to execute shell commands, specifically using curl to download a helper script and node to execute it for data retrieval.
  • [EXTERNAL_DOWNLOADS]: The skill downloads its primary logic script (call.mjs) and an integrity verification hash from the vendor's domain at https://fittings.sh.
  • [DYNAMIC_EXECUTION]: The client script uses dynamic import() to load dependencies such as viem and @x402/fetch and reads its own file content from disk to verify its integrity against a remote hash.
  • [CREDENTIALS_UNSAFE]: The skill requires a blockchain private key provided through the FITTINGS_PRIVATE_KEY environment variable to sign payment authorizations. While this is the intended mechanism for the paid service and the documentation warns users to use a throwaway wallet, the practice of handling private keys in environment variables introduces a risk of credential exposure.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 05:17 AM