The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses scripts/call.mjs to interface with the fittings.sh API. This script executes standard network requests to fetch financial data and metadata.
[EXTERNAL_DOWNLOADS]: The skill fetches catalog data and financial information from https://fittings.sh. These are vendor-owned resources used for the primary purpose of the skill.
[CREDENTIALS_UNSAFE]: The documentation references the environment variable FITTINGS_PRIVATE_KEY for payment processing. This is a standard practice for managing secrets in automated environments. The script itself does not exfiltrate this key; it uses it locally to sign payment authorizations for the data service.
[REMOTE_CODE_EXECUTION]: The script scripts/call.mjs contains a self-integrity check that compares its own SHA256 hash against a version served by fittings.sh. While it suggests the user download an update via curl if a mismatch is found, it does not automatically execute remote code.

finance-reference