road-nearest

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download a companion script (call.mjs) from the vendor's official website at https://fittings.sh/skill/call.mjs. This script facilitates interaction with the geography API and the payment system.\n- [COMMAND_EXECUTION]: The skill leverages the Node.js runtime to execute the call.mjs script. This script processes command-line arguments to build and sign API requests directed at the fittings.sh endpoint.\n- [CREDENTIALS_UNSAFE]: The skill requires a private key to be provided through the FITTINGS_PRIVATE_KEY environment variable. The key is used locally by the viem library to generate signatures for metered payments. The skill instructions recommend using a throwaway wallet to protect user funds.\n- [REMOTE_CODE_EXECUTION]: The call.mjs script performs dynamic imports of dependencies like @x402/fetch and viem to handle networking and cryptographic signatures. It also implements a self-integrity check by comparing its SHA-256 hash with a version hosted on the vendor's server.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 05:17 AM