The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses node call.mjs to execute its primary logic and curl to fetch the catalog or script. These are standard operations for a CLI-based agent skill.
[EXTERNAL_DOWNLOADS]: The skill fetches configuration and a helper script from https://fittings.sh, which is the official domain for the skill vendor 'fittings-sh'. This is considered a safe vendor-related resource.
[REMOTE_CODE_EXECUTION]: The documentation suggests fetching call.mjs via curl if it is missing. While downloading and executing code is generally high-risk, in this context, it is fetching a version-controlled script from the vendor's own infrastructure to maintain functionality.
[CREDENTIALS_UNSAFE]: The script requires a FITTINGS_PRIVATE_KEY to perform paid transactions. The instructions correctly advise users to use a throwaway wallet with limited funds and note that the key remains in plaintext in the environment, which is a transparent disclosure of the security model for this specific use case (blockchain-based micropayments).

fec-financial-totals