swpc-space-weather-scales
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation provides instructions to download and execute a script (
call.mjs) from a remote server (fittings.sh) if it is missing from the skill package. - [CREDENTIALS_UNSAFE]: The skill instructions direct the user to store a blockchain private key in the
FITTINGS_PRIVATE_KEYenvironment variable, which is then read and used by thecall.mjsscript for cryptographic signing. - [COMMAND_EXECUTION]: The skill implementation relies on the execution of a Node.js process to run the
call.mjsscript, which handles network communication and payment logic. - [EXTERNAL_DOWNLOADS]: The script performs network requests to the
fittings.shcatalog to retrieve service metadata, price quotes, and integrity verification hashes.
Audit Metadata