The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires a cryptocurrency private key to be provided via the FITTINGS_PRIVATE_KEY environment variable for payment signing. While the documentation recommends using a throwaway wallet, handling raw private keys in environment variables creates a significant security surface for AI agents.
Evidence: SKILL.md provides usage examples with export FITTINGS_PRIVATE_KEY=0x... and call.mjs reads this value to authorize transactions.
[EXTERNAL_DOWNLOADS]: The skill instructions suggest downloading the call.mjs client script directly from the vendor's website if it is not already present in the skill package.
Evidence: SKILL.md contains the instruction: curl -sO https://fittings.sh/skill/call.mjs.
[REMOTE_CODE_EXECUTION]: The skill relies on the execution of the call.mjs script, which performs network operations to facilitate blockchain payments and dynamically imports third-party cryptographic libraries.
Evidence: call.mjs uses fetch for API interaction and dynamic import() for Node.js packages including viem and @x402/fetch.

airport-nearby