The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the user to provide a blockchain private key via the FITTINGS_PRIVATE_KEY environment variable. This key is used by the call.mjs script to sign payment authorizations. Handling sensitive cryptographic keys in plaintext environment variables is a security risk, as these values can be exposed through process monitoring, shell history, or local logging mechanisms.
[EXTERNAL_DOWNLOADS]: The documentation suggests that if the call.mjs script is missing, the user should download it directly from the vendor's infrastructure using curl -sO https://fittings.sh/skill/call.mjs. Fetching and executing remote scripts creates a dependency on the integrity and availability of the external vendor site.
[COMMAND_EXECUTION]: The skill relies on executing a local Node.js script (call.mjs) to perform its operations. This script takes user-supplied arguments, constructs network requests, and performs cryptographic signing operations at runtime.

email-deliverability