The Agent Skills Directory

[DATA_EXPOSURE]: The skill instructs users to set a sensitive cryptocurrency private key (FITTINGS_PRIVATE_KEY) as an environment variable to enable paid features. The scripts/call.mjs script accesses this variable to sign blockchain transactions for service payments.
[EXTERNAL_DEPENDENCIES]: The execution of scripts/call.mjs requires the installation of several external Node.js packages to handle network communication and cryptographic signing. Evidence: The script requires @x402/fetch, @x402/evm, and viem to be installed via npm.
[DYNAMIC_EXECUTION]: The script scripts/call.mjs utilizes dynamic imports to load its dependencies and performs a self-integrity check at runtime. Evidence: Use of await import() for modular dependencies and readFileSync combined with createHash to verify the script's own integrity against a remote hash served by fittings.sh.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data such as street addresses and geographic coordinates, which could potentially contain malicious instructions. Ingestion points: User-provided addresses and coordinates passed as command-line arguments to scripts/call.mjs. Boundary markers: The documentation suggests comparing the API's matchedAddress field against user input, but no explicit delimiters are enforced in the data flow. Capability inventory: The script has the capability to perform network requests (fetch) and read from the local filesystem (readFileSync). Sanitization: Relies on the external Census Bureau geocoder for input normalization.

geo-lookup