noaa-coops-station-data
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the user to execute shell commands, specifically using
curlto download a helper script andnodeto execute it for data retrieval. - [EXTERNAL_DOWNLOADS]: The skill downloads its primary logic script (
call.mjs) and an integrity verification hash from the vendor's domain athttps://fittings.sh. - [DYNAMIC_EXECUTION]: The client script uses dynamic
import()to load dependencies such asviemand@x402/fetchand reads its own file content from disk to verify its integrity against a remote hash. - [CREDENTIALS_UNSAFE]: The skill requires a blockchain private key provided through the
FITTINGS_PRIVATE_KEYenvironment variable to sign payment authorizations. While this is the intended mechanism for the paid service and the documentation warns users to use a throwaway wallet, the practice of handling private keys in environment variables introduces a risk of credential exposure.
Audit Metadata