spatial-point-in-polygon

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The SKILL.md documentation provides example curl commands for users to test the API endpoint and fetch the call.mjs script. These are standard documentation examples for a web service.- [EXTERNAL_DOWNLOADS]: The skill instructions suggest downloading a helper script call.mjs from the vendor's domain fittings.sh if it is not already present. This is documented as a convenience for the user to interact with the service.- [CREDENTIALS_UNSAFE]: The skill interacts with a sensitive environment variable FITTINGS_PRIVATE_KEY for processing payments. The documentation explicitly warns the user to use a throwaway wallet and explains that the key is stored in plaintext, which is a transparent disclosure of the security model for this specific payment protocol. It does not contain hardcoded secrets.- [REMOTE_CODE_EXECUTION]: The call.mjs script imports several external libraries (@x402/fetch, @x402/evm, viem) to handle blockchain signatures and network requests. These are standard dependencies for the declared functionality of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 05:16 AM