sec-filing-search
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill implementation utilizes an Ethereum private key provided via the
FITTINGS_PRIVATE_KEYenvironment variable. This key is used locally by the helper script to sign payment authorizations for metered API access. The skill documentation provides explicit security guidance, recommending the use of a dedicated throwaway wallet to limit potential exposure of funds. - [EXTERNAL_DOWNLOADS]: The documentation references and provided code includes a helper script (
call.mjs) hosted on the vendor's official domain (fittings.sh). This script is designed to facilitate the x402 payment protocol handshake and ensure transaction integrity. - [COMMAND_EXECUTION]: The skill involves executing a Node.js script (
call.mjs) which performs network operations to interact with the SEC search API. Additionally, the script performs a self-integrity check by reading its own file content to generate a SHA-256 hash and comparing it against a known-good hash fetched from the vendor's gateway.
Audit Metadata