The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requests a private key via the FITTINGS_PRIVATE_KEY environment variable to sign off-chain payment authorizations. The accompanying documentation correctly highlights the risk of storing keys in plaintext and recommends using a dedicated, low-balance wallet. The script uses the viem library to perform all signing operations locally on the agent's machine, ensuring credentials are not transmitted to the network.
[EXTERNAL_DOWNLOADS]: The instructions suggest downloading the call.mjs script directly from the vendor's domain (fittings.sh) if the file is missing from the skill directory. Additionally, the script performs a network check to verify its own SHA256 integrity hash against the vendor's server before initiating any paid calls.
[COMMAND_EXECUTION]: The skill facilitates the execution of a Node.js script (call.mjs) which acts as the primary interface for the financial API. This script manages argument parsing, schema validation, and the automated 402 Payment Required handshake process.
[REMOTE_CODE_EXECUTION]: The skill dynamically imports the @x402/fetch, @x402/evm, and viem packages for its core functionality. These are standard cryptographic and networking libraries used to support the x402 protocol and blockchain interactions.
[DATA_EXFILTRATION]: Network requests are performed to the fittings.sh gateway to retrieve pricing quotes and submit signed authorizations. No patterns were detected indicating unauthorized data access or transmission to third-party domains.

fx-ecb-timeseries