The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires a cryptocurrency private key (FITTINGS_PRIVATE_KEY) to be stored in an environment variable for signing payment authorizations. The documentation acknowledges that the key will be stored in plaintext, which is a sensitive practice for managing wallet credentials.
[EXTERNAL_DOWNLOADS]: The skill includes instructions to download an updated version of its core logic (call.mjs) from an external vendor-controlled domain (https://fittings.sh/skill/call.mjs) using curl.
[REMOTE_CODE_EXECUTION]: The skill executes the call.mjs script, which handles cryptographic operations and network requests. The script also includes a self-verification mechanism that fetches a remote hash to check for updates, potentially leading to the execution of updated code.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands, specifically node to run the payment client and curl for interacting with the vendor's API and catalog.

ghsa-advisory