time-compute
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill utilizes a sensitive private key to sign blockchain transactions for payment settlement.
- Evidence: The instructions in
SKILL.mdrequest the user to setFITTINGS_PRIVATE_KEYin their environment variables. - Evidence:
scripts/call.mjsreads this variable to create a signer account using theviemlibrary. - Note: The skill includes explicit warnings to never print, commit, or expose this key to the user, and uses it for local signing rather than remote transmission.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to interact with its backend services and verify script integrity.
- Evidence:
scripts/call.mjsfetches a SHA-256 checksum fromhttps://fittings.sh/skill/call.mjs.sha256to ensure the local script matches the current gateway version. - Evidence: The script makes API calls to
https://fittings.shto retrieve calendar, timezone, and solar data. - [COMMAND_EXECUTION]: The skill executes a local Node.js helper script to perform data processing and payment handshakes.
- Evidence:
SKILL.mdcontains worked examples usingnode scripts/call.mjsto interact with the various time services. - Evidence: The script dynamically imports necessary cryptographic and network libraries to handle the x402 protocol logic.
Audit Metadata