The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires a blockchain private key for payment authorization.
Evidence: The user is instructed to set the FITTINGS_PRIVATE_KEY environment variable for the call.mjs script.
Risk: Storing a private key in the execution environment as plaintext is a security risk as it can be accessed by the agent or leaked through process logs.
[EXTERNAL_DOWNLOADS]: The skill instructions include steps to download an executable script from a remote URL.
Evidence: SKILL.md contains the command curl -sO https://fittings.sh/skill/call.mjs to fetch the client helper script.
[REMOTE_CODE_EXECUTION]: The helper script involves dynamic loading of external logic and remote verification.
Evidence: The call.mjs script performs an integrity check by fetching a SHA256 hash from https://fittings.sh/skill/call.mjs.sha256 at runtime before proceeding.
Evidence: The script dynamically imports third-party Node.js libraries (@x402/fetch, @x402/evm, viem) to handle payment protocol handshakes and transaction signing.

ctgov-eligibility-screen