weather-live

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on executing a local script scripts/call.mjs to interact with the Weather and Earth catalog services. This script handles parameter validation and service discovery.
  • [EXTERNAL_DOWNLOADS]: The skill fetches service definitions, schemas, and integrity hashes from the vendor's infrastructure at fittings.sh. It also depends on standard external libraries for blockchain communication (viem) and payment handshakes (@x402/fetch).
  • [CREDENTIALS_UNSAFE]: The skill requires a private key to be set in the FITTINGS_PRIVATE_KEY environment variable for transaction signing. The documentation includes explicit security warnings to ensure the agent does not leak this key in its output or logs, following standard secret management practices.
  • [REMOTE_CODE_EXECUTION]: The script performs an integrity check of its own source code against a remote hash on fittings.sh. It identifies if the local client is outdated and suggests a manual update, but does not perform silent or arbitrary remote code execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 05:17 AM