tz-offset-at
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a legitimate client-side payment protocol (x402) to access metered API services. The
call.mjsscript manages the handshake between the agent and thefittings.shgateway. - [SAFE]: Sensitive data handling is restricted to the
FITTINGS_PRIVATE_KEYenvironment variable. The script uses this key locally via theviemlibrary to sign payment challenges; the key itself is not transmitted over the network. - [SAFE]: The script includes an integrity verification mechanism that compares its own SHA-256 hash against a value fetched from
https://fittings.sh/skill/call.mjs.sha256. This ensures the payment logic remains synchronized with the gateway's requirements. - [SAFE]: All external dependencies, including
@x402/fetch,@x402/evm, andviem, are appropriate for the skill's purpose of facilitating blockchain-based payments.
Audit Metadata