The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a JavaScript client script (call.mjs) from the vendor's domain https://fittings.sh/skill/call.mjs using curl at runtime.\n- [REMOTE_CODE_EXECUTION]: The skill executes the downloaded call.mjs script using node. This introduces a runtime execution path for code that is not contained within the statically analyzed skill file, bypassing local security review.\n- [COMMAND_EXECUTION]: The instructions rely on curl to fetch configuration data and executable scripts from remote servers.\n- [CREDENTIALS_UNSAFE]: The skill instructions prompt the user to export a raw blockchain private key (FITTINGS_PRIVATE_KEY) as a plaintext environment variable. Storing private keys in the environment is a high-risk practice as they can be exposed to other processes, included in environment logs, or accidentally leaked through process debugging.

fittings-crypto-random-bytes