The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill requires and accesses the FITTINGS_PRIVATE_KEY environment variable to sign payment authorizations. The documentation explicitly warns that this key is stored in plaintext where the agent runs and recommends using a dedicated wallet for this purpose.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The instructions recommend downloading a helper script, call.mjs, directly from the vendor's domain https://fittings.sh/skill/call.mjs. As this is a vendor-owned resource corresponding to the skill author, this is considered standard deployment behavior.
[DYNAMIC_EXECUTION]: The call.mjs script utilizes dynamic import() statements to load the @x402/fetch, @x402/evm, and viem libraries at runtime to handle blockchain-based payments.
[INDIRECT_PROMPT_INJECTION]: The skill processes external address data which is sent to a remote API.
Ingestion points: The addresses array in the JSON payload or command-line arguments passed to call.mjs.
Boundary markers: Data is transmitted as a structured JSON object, providing separation between instructions and data.
Capability inventory: The script has capabilities for network communication and cryptographic signing.
Sanitization: The call.mjs script performs basic type validation (string, number, boolean, array, object) before constructing the request body.

census-geocode-batch