The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documentation includes curl commands for querying service metadata and performing dry runs of the data profiling endpoint. These commands are informational and target the vendor's official domain (fittings.sh).
[EXTERNAL_DOWNLOADS]: The skill provides instructions to fetch its execution script (call.mjs) via curl if it is missing. The download source is the vendor's official domain (https://fittings.sh/skill/call.mjs). This is standard procedure for the skill's functionality.
[DATA_EXFIILLTRATION]: While the skill involves sending data (CSV/NDJSON) to a remote endpoint (https://fittings.sh/v1/data/column-profile), this is the primary and explicit purpose of the skill. The data sent is user-provided and intended for profiling; no background exfiltration of sensitive files or system credentials was found.
[CREDENTIALS_UNSAFE]: The skill uses a FITTINGS_PRIVATE_KEY environment variable for blockchain-based payments. The documentation correctly advises users to use a throwaway wallet with minimal funds and explains that the key remains in plaintext in the execution environment. This is a transparent disclosure of the security model for this specific payment technology rather than a vulnerability.
[REMOTE_CODE_EXECUTION]: The call.mjs script performs dynamic imports of @x402 and viem libraries to handle cryptocurrency signatures and network interactions. These are well-known libraries for EVM interactions, and their use is consistent with the skill's stated payment mechanism.

data-column-profile