semver-range-resolve
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires a cryptocurrency private key to be stored in the
FITTINGS_PRIVATE_KEYenvironment variable to facilitate metered payments. The documentation correctly warns users about the risks of plaintext storage and suggests using a throwaway wallet. - [EXTERNAL_DOWNLOADS]: The instructions direct the agent to download the execution script (
call.mjs) directly from the vendor's website (https://fittings.sh/skill/call.mjs) if it is not already present. - [REMOTE_CODE_EXECUTION]: The provided
call.mjsscript utilizes dynamicimport()to load external libraries (@x402/fetch, @x402/evm, and viem). It also contains a security feature that hashes its own source code and compares it against a remote value athttps://fittings.sh/skill/call.mjs.sha256to ensure it is not out of date before signing transactions. - [COMMAND_EXECUTION]: The skill involves executing shell commands via
nodeandcurlto manage dependencies, download scripts, and interact with the paid API service.
Audit Metadata