skills/fittings-sh/skills/qr-generate/Gen Agent Trust Hub

qr-generate

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation provides a command to download the call.mjs helper script from the author's domain at https://fittings.sh/skill/call.mjs to enable full functionality.
  • [CREDENTIALS_UNSAFE]: The tool utilizes the FITTINGS_PRIVATE_KEY environment variable to sign payment challenges. The script uses this key locally with the viem library to perform cryptographic signatures for the x402 payment protocol.
  • [COMMAND_EXECUTION]: The provided call.mjs script performs network communication with the vendor's API and utilizes dynamic imports for its dependencies, including Ethereum client libraries for transaction signing.
  • [REMOTE_CODE_EXECUTION]: The helper script implements a self-verification routine that fetches a remote hash from https://fittings.sh/skill/call.mjs.sha256 and compares it to its own local hash to ensure the payment logic is up to date before proceeding with transactions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 05:16 AM