time-compute

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill utilizes a sensitive private key to sign blockchain transactions for payment settlement.
  • Evidence: The instructions in SKILL.md request the user to set FITTINGS_PRIVATE_KEY in their environment variables.
  • Evidence: scripts/call.mjs reads this variable to create a signer account using the viem library.
  • Note: The skill includes explicit warnings to never print, commit, or expose this key to the user, and uses it for local signing rather than remote transmission.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to interact with its backend services and verify script integrity.
  • Evidence: scripts/call.mjs fetches a SHA-256 checksum from https://fittings.sh/skill/call.mjs.sha256 to ensure the local script matches the current gateway version.
  • Evidence: The script makes API calls to https://fittings.sh to retrieve calendar, timezone, and solar data.
  • [COMMAND_EXECUTION]: The skill executes a local Node.js helper script to perform data processing and payment handshakes.
  • Evidence: SKILL.md contains worked examples using node scripts/call.mjs to interact with the various time services.
  • Evidence: The script dynamically imports necessary cryptographic and network libraries to handle the x402 protocol logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 05:16 AM