time-timezone-convert
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill instructions suggest downloading a helper script (call.mjs) from the vendor's domain (fittings.sh) using curl. This script is the primary client for interacting with the service and includes an integrity check that fetches its own expected hash from the vendor's server.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill utilizes a blockchain private key (stored in the FITTINGS_PRIVATE_KEY environment variable) to authorize payments. The script performs network requests to fittings.sh to transmit signed payment authorizations. The documentation includes clear security warnings advising users to use throwaway wallets for this purpose.\n- [DYNAMIC_EXECUTION]: The provided call.mjs script uses dynamic import() calls to load necessary external libraries for its blockchain and network functionality (@x402/fetch, @x402/evm, and viem). This is standard procedure for the cryptographically signed payment protocol implemented by the vendor.
Audit Metadata