The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads a utility script (call.mjs) from the vendor's domain https://fittings.sh/skill/call.mjs to facilitate API interactions.
[COMMAND_EXECUTION]: The documentation provides instructions to execute the downloaded script using node call.mjs, which runs the remote code in the local environment.
[REMOTE_CODE_EXECUTION]: The combination of downloading a script via curl and immediately executing it with node constitutes a remote code execution pattern, though it is sourced from the vendor's own infrastructure.
[CREDENTIALS_UNSAFE]: The skill instructs the user to set a sensitive private key (FITTINGS_PRIVATE_KEY) as an environment variable. While the documentation advises using a throwaway wallet, storing keys in plaintext environment variables poses a risk of exposure to the agent or other processes.
[DATA_EXPOSURE]: Text data is sent to the external endpoint https://fittings.sh/v1/text/sentiment for processing. While this is the primary purpose of the skill, users should be aware that their content is transmitted to a third-party service.

fittings-text-sentiment