The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides example commands using node to execute the provided call.mjs script and curl for fetching metadata. These are intended for the user to interact with the service.
[EXTERNAL_DOWNLOADS]: The documentation suggests fetching the client script via curl -sO https://fittings.sh/skill/call.mjs if it is missing. This is a reference to the vendor's own infrastructure (fittings-sh).
[CREDENTIALS_UNSAFE]: The skill uses a FITTINGS_PRIVATE_KEY environment variable to sign blockchain transactions for payment. While handling raw private keys is inherently sensitive, the skill explicitly warns the user to use a throwaway wallet, explains that the key is stored in plaintext where the agent runs, and provides a dry-run mode that functions without a key to prevent accidental spending.
[REMOTE_CODE_EXECUTION]: The script call.mjs dynamically imports several libraries (@x402/fetch, @x402/evm, viem). These are standard dependencies for the x402 payment protocol and blockchain interactions.
[DATA_EXFILTRATION]: The script sends request parameters to https://fittings.sh. This is the primary function of the skill (fetching flood zone data) and targets the vendor's own API.

fema-flood-zone