weather-live
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing a local script
scripts/call.mjsto interact with the Weather and Earth catalog services. This script handles parameter validation and service discovery. - [EXTERNAL_DOWNLOADS]: The skill fetches service definitions, schemas, and integrity hashes from the vendor's infrastructure at
fittings.sh. It also depends on standard external libraries for blockchain communication (viem) and payment handshakes (@x402/fetch). - [CREDENTIALS_UNSAFE]: The skill requires a private key to be set in the
FITTINGS_PRIVATE_KEYenvironment variable for transaction signing. The documentation includes explicit security warnings to ensure the agent does not leak this key in its output or logs, following standard secret management practices. - [REMOTE_CODE_EXECUTION]: The script performs an integrity check of its own source code against a remote hash on
fittings.sh. It identifies if the local client is outdated and suggests a manual update, but does not perform silent or arbitrary remote code execution.
Audit Metadata