solar-twilight-windows
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires downloading a management script (
call.mjs) from the vendor's official domain (fittings.sh). It also specifies dependencies on standard cryptographic and blockchain interaction libraries (viem,@x402/fetch,@x402/evm) from the npm registry. - [CREDENTIALS_UNSAFE]: To facilitate paid API calls, the skill uses a private key provided via the
FITTINGS_PRIVATE_KEYenvironment variable. The documentation provides clear security warnings, recommending the use of a dedicated throwaway wallet for this purpose. - [COMMAND_EXECUTION]: The helper script
call.mjsperforms a self-integrity check at runtime by calculating its own SHA-256 hash and comparing it to a reference hash hosted on the vendor's gateway to ensure the code has not been tampered with or become outdated. - [DATA_EXFILTRATION]: Network requests are made to
fittings.shto retrieve solar data and submit signed payment authorizations. These operations are essential to the skill's function and are restricted to the vendor's verified infrastructure.
Audit Metadata