road-nearest
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download a companion script (
call.mjs) from the vendor's official website athttps://fittings.sh/skill/call.mjs. This script facilitates interaction with the geography API and the payment system.\n- [COMMAND_EXECUTION]: The skill leverages the Node.js runtime to execute thecall.mjsscript. This script processes command-line arguments to build and sign API requests directed at thefittings.shendpoint.\n- [CREDENTIALS_UNSAFE]: The skill requires a private key to be provided through theFITTINGS_PRIVATE_KEYenvironment variable. The key is used locally by theviemlibrary to generate signatures for metered payments. The skill instructions recommend using a throwaway wallet to protect user funds.\n- [REMOTE_CODE_EXECUTION]: Thecall.mjsscript performs dynamic imports of dependencies like@x402/fetchandviemto handle networking and cryptographic signatures. It also implements a self-integrity check by comparing its SHA-256 hash with a version hosted on the vendor's server.
Audit Metadata