nws-point-forecast
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation provides instructions to fetch the necessary client script (
call.mjs) from the vendor's official domain athttps://fittings.sh/skill/call.mjs. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
node call.mjsto interact with the weather service and manage payment quotes. - [REMOTE_CODE_EXECUTION]: The
call.mjsscript uses dynamic imports (await import) to load payment and blockchain libraries, including@x402/fetch,@x402/evm, andviem, at runtime to facilitate the x402 payment protocol. - [SAFE]: The skill handles sensitive credentials (private keys) using environment variables, which is a standard practice for local agent tools, and includes a self-integrity check that hashes the script to verify it against the vendor's registry before execution.
Audit Metadata