The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires an Ethereum private key to be stored in the FITTINGS_PRIVATE_KEY environment variable for transaction signing. While the documentation advises using a throwaway wallet, storing secrets in environment variables exposes them to any process or agent with access to the execution environment.
[EXTERNAL_DOWNLOADS]: The documentation instructs users to download the core execution script call.mjs directly from the vendor's domain (https://fittings.sh/skill/call.mjs) if it is not present in the local directory.
[COMMAND_EXECUTION]: The skill operates by running a Node.js script (call.mjs) that performs network requests to the vendor's API, reads its own bytes from the file system for integrity checks, and executes cryptographic functions to sign payment authorizations.
[REMOTE_CODE_EXECUTION]: The execution script includes a self-integrity check that compares its local hash with a remote source (https://fittings.sh/skill/call.mjs.sha256). If the hashes do not match, the script prompts the user to re-download and execute a new version from the vendor's server, which serves as a manual remote update mechanism.

epss-score