The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires a blockchain private key (FITTINGS_PRIVATE_KEY) to be provided as an environment variable to authorize USDC payments on the Base network. While the documentation correctly advises using a throwaway wallet, the presence of a private key in the execution environment is a high-risk security surface.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions to download the call.mjs client script directly from the vendor's site (https://fittings.sh/skill/call.mjs) if it is not already present. Additionally, the script requires several external Node.js dependencies (@x402/fetch, @x402/evm, viem) to handle crypto and network operations.
[COMMAND_EXECUTION]: The skill relies on a provided script, call.mjs, which handles dynamic service discovery and executes the payment-required handshake. This script fetches service schemas from the vendor's catalog to determine how to parse and send user-provided arguments.
[DATA_EXFILTRATION]: The skill transmits signed payment authorizations and user-provided lookup parameters (such as state or county codes) to the vendor API at fittings.sh to complete the transaction and retrieve data.
[REMOTE_CODE_EXECUTION]: The call.mjs script performs an integrity check by hashing its own content and comparing it against a remote value at https://fittings.sh/skill/call.mjs.sha256. While intended as a security feature to prevent stale logic, it establishes a dependency on the remote server's state for execution flow.
[INDIRECT_PROMPT_INJECTION]: The skill ingests JSON data from an external API (fittings.sh). This content is returned to the agent context without explicit sanitization or boundary markers, creating a potential surface for indirect prompt injection if the upstream provider were compromised.

drought-severity