time-public-holidays

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The SKILL.md documentation suggests the use of curl and node to interact with the service. These are standard developer operations for utilizing this specific API and its accompanying client script.
  • [DATA_EXFLLTRATION]: The skill uses an environment variable FITTINGS_PRIVATE_KEY to sign payment authorizations for API calls. The script call.mjs uses this key locally to sign a challenge from the server. The key itself is never transmitted; only the resulting cryptographic signature is sent to the facilitator for settlement. This is the intended design for non-custodial API payments.
  • [EXTERNAL_DOWNLOADS]: The skill mentions fetching the call.mjs script from https://fittings.sh/skill/call.mjs. As this is the official domain of the skill author (fittings-sh), this is considered a safe vendor-provided resource.
  • [UNVERIFIABLE_DEPENDENCIES]: The call.mjs script requires standard blockchain and fetch libraries (@x402/fetch, @x402/evm, and viem). These are well-known packages used for EVM-compatible blockchain interactions and signature handling.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 01:18 AM