The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the user to execute node call.mjs and curl commands. These are standard operational instructions for the skill's functionality. The call.mjs script performs network requests to the vendor's domain (fittings.sh) to fetch service metadata and execute geocoding calls.
[EXTERNAL_DOWNLOADS]: The skill mentions downloading call.mjs via curl -sO https://fittings.sh/skill/call.mjs. As this is the vendor's own domain and is the primary delivery mechanism for the skill's logic, this is documented neutrally as a functional requirement.
[CREDENTIALS_SAFE]: The skill uses an environment variable FITTINGS_PRIVATE_KEY for blockchain signatures. The instructions correctly advise users to use a 'throwaway wallet' and note that the key sits in plaintext where the agent runs, demonstrating transparency about the risks of local key storage. It does not exfiltrate this key to untrusted third parties; it is used locally to sign payment authorizations for the fittings.sh gateway.
[REMOTE_CODE_EXECUTION]: The call.mjs script dynamically imports several packages (@x402/fetch, @x402/evm, viem). These are standard dependencies for the x402 payment protocol and are handled via standard Node.js module resolution. The script also includes a self-integrity check that compares its SHA256 hash against the version on the vendor's server, which is a defensive measure to prevent version mismatch during financial transactions.

census-address-geographies