The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the exposure of a blockchain private key via the FITTINGS_PRIVATE_KEY environment variable. This key is used for signing blockchain transactions to settle API costs. The documentation warns that the key resides in plaintext within the agent's environment, posing a risk of credential exfiltration.- [EXTERNAL_DOWNLOADS]: The skill instructions include commands to download the call.mjs script from the vendor's domain (https://fittings.sh/skill/call.mjs) if it is not found locally.- [COMMAND_EXECUTION]: The skill functions by executing a Node.js script that processes sensitive environment variables and user-supplied arguments to interact with the payment gateway.- [REMOTE_CODE_EXECUTION]: The helper script performs dynamic import() of external dependencies (@x402/fetch, @x402/evm, viem) and validates its own integrity by fetching a SHA256 hash from a remote server before proceeding with execution.

govinfo-public-law