The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the user to execute node call.mjs with arguments. The call.mjs script processes these arguments through a parseArgs function which uses JSON.parse for object types and performs basic type coercion. While it does not directly use eval(), the script manages data flow from command-line arguments into network requests that handle cryptographic signatures, increasing the risk surface for local command injection or logic flaws.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download a script via curl -sO https://fittings.sh/skill/call.mjs. It also attempts to verify the integrity of the local script by fetching a SHA256 hash from https://fittings.sh/skill/call.mjs.sha256. While the host fittings.sh is the vendor site for this skill, downloading and executing scripts from remote sources at runtime is a notable security consideration.
[CREDENTIALS_UNSAFE]: The skill uses the FITTINGS_PRIVATE_KEY environment variable to store an EVM-compatible private key. The documentation correctly warns that this key 'sits in plaintext wherever the agent runs' and advises the use of a 'throwaway wallet holding a few dollars'. However, the presence of raw private keys in the execution environment is a high-risk pattern for data exposure if the environment is compromised.

govinfo-us-code-section