time-public-holidays
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The SKILL.md documentation suggests the use of
curlandnodeto interact with the service. These are standard developer operations for utilizing this specific API and its accompanying client script. - [DATA_EXFLLTRATION]: The skill uses an environment variable
FITTINGS_PRIVATE_KEYto sign payment authorizations for API calls. The scriptcall.mjsuses this key locally to sign a challenge from the server. The key itself is never transmitted; only the resulting cryptographic signature is sent to the facilitator for settlement. This is the intended design for non-custodial API payments. - [EXTERNAL_DOWNLOADS]: The skill mentions fetching the
call.mjsscript fromhttps://fittings.sh/skill/call.mjs. As this is the official domain of the skill author (fittings-sh), this is considered a safe vendor-provided resource. - [UNVERIFIABLE_DEPENDENCIES]: The
call.mjsscript requires standard blockchain and fetch libraries (@x402/fetch,@x402/evm, andviem). These are well-known packages used for EVM-compatible blockchain interactions and signature handling.
Audit Metadata