qr-generate
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation provides a command to download the
call.mjshelper script from the author's domain athttps://fittings.sh/skill/call.mjsto enable full functionality. - [CREDENTIALS_UNSAFE]: The tool utilizes the
FITTINGS_PRIVATE_KEYenvironment variable to sign payment challenges. The script uses this key locally with theviemlibrary to perform cryptographic signatures for the x402 payment protocol. - [COMMAND_EXECUTION]: The provided
call.mjsscript performs network communication with the vendor's API and utilizes dynamic imports for its dependencies, including Ethereum client libraries for transaction signing. - [REMOTE_CODE_EXECUTION]: The helper script implements a self-verification routine that fetches a remote hash from
https://fittings.sh/skill/call.mjs.sha256and compares it to its own local hash to ensure the payment logic is up to date before proceeding with transactions.
Audit Metadata