spatial-nearest-point
Warn
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires the user to provide a raw blockchain private key via the
FITTINGS_PRIVATE_KEYenvironment variable. The documentation acknowledges that this key is stored in plaintext where the agent runs and recommends using a 'throwaway wallet' because of the inherent risk of key exposure. - [EXTERNAL_DOWNLOADS]: The documentation instructs the user to download an execution script from an external domain (
https://fittings.sh/skill/call.mjs) usingcurlif the file is not already present. While this domain belongs to the skill vendor, downloading and executing remote scripts is a significant security vector. - [COMMAND_EXECUTION]: The skill relies on the execution of a local Node.js script (
call.mjs) that performs network operations, signs cryptographic challenges using the provided private key, and verifies its own integrity by fetching a hash from the vendor's server.
Audit Metadata