spatial-point-in-polygon
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The SKILL.md documentation provides example
curlcommands for users to test the API endpoint and fetch thecall.mjsscript. These are standard documentation examples for a web service.- [EXTERNAL_DOWNLOADS]: The skill instructions suggest downloading a helper scriptcall.mjsfrom the vendor's domainfittings.shif it is not already present. This is documented as a convenience for the user to interact with the service.- [CREDENTIALS_UNSAFE]: The skill interacts with a sensitive environment variableFITTINGS_PRIVATE_KEYfor processing payments. The documentation explicitly warns the user to use a throwaway wallet and explains that the key is stored in plaintext, which is a transparent disclosure of the security model for this specific payment protocol. It does not contain hardcoded secrets.- [REMOTE_CODE_EXECUTION]: Thecall.mjsscript imports several external libraries (@x402/fetch,@x402/evm,viem) to handle blockchain signatures and network requests. These are standard dependencies for the declared functionality of the skill.
Audit Metadata