The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file contains documentation on how to use curl and node to interact with the service. These are provided as usage examples for the user to execute manually and are not automatically triggered by the agent.
[REMOTE_CODE_EXECUTION]: The call.mjs script performs a self-integrity check by hashing itself and comparing it against a remote hash at https://fittings.sh/skill/call.mjs.sha256. If a mismatch is detected, it advises the user to manually update the script. This is a security feature to prevent execution of stale payment logic and does not involve automatic remote code execution.
[CREDENTIALS_UNSAFE]: The skill uses an environment variable FITTINGS_PRIVATE_KEY for blockchain signatures. The documentation correctly advises using a throwaway wallet with minimal funds and explains the risks of storing keys in plaintext environment variables. No secrets are hardcoded in the skill itself.
[EXTERNAL_DOWNLOADS]: The skill fetches data from fittings.sh (the author's domain) and references standard libraries like @x402/fetch, @x402/evm, and viem from the NPM registry for its payment and cryptographic operations. These are legitimate dependencies for the stated purpose of the skill.

cve-lookup