The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the user to provide a private key via the FITTINGS_PRIVATE_KEY environment variable. This key is used by the call.mjs script to sign transactions for the x402 payment protocol. The documentation explicitly advises users to use a throwaway wallet holding minimal funds.
[EXTERNAL_DOWNLOADS]: The skill instructions include a command to download a client script (call.mjs) directly from the vendor's domain (https://fittings.sh/skill/call.mjs). Additionally, the script fetches an integrity hash (call.mjs.sha256) from the same domain at runtime to verify its own version.
[REMOTE_CODE_EXECUTION]: The call.mjs script uses dynamic import() statements to load several external dependencies at runtime, including @x402/fetch, @x402/evm, and viem libraries. These are required for the payment and network communication logic.
[COMMAND_EXECUTION]: The documentation provides examples for executing shell commands, including curl for downloading scripts and metadata, and node for running the payment client. The call.mjs script itself executes within the Node.js runtime to perform network operations and cryptographic signing.
[INDIRECT_PROMPT_INJECTION]: The skill processes vulnerability data fetched from the National Vulnerability Database (NVD). As this involves ingesting external, third-party descriptions of security vulnerabilities, it presents an indirect prompt injection surface where malicious content in a CVE description could influence the agent's behavior.

cve-search