The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions direct the user to set a blockchain private key in the FITTINGS_PRIVATE_KEY environment variable. This key is used by the execution script to sign payment authorizations for API calls. While the documentation recommends using a throwaway wallet, this practice involves handling sensitive cryptographic material in the shell environment where it may be recorded in history or accessed by other processes.
[EXTERNAL_DOWNLOADS]: The documentation provides a command to download the execution script call.mjs directly from the vendor's website (fittings.sh) using curl if the file is not already present in the local environment.
[COMMAND_EXECUTION]: The skill relies on the execution of a Node.js script (call.mjs) via the command line to perform lookups and handle the payment handshake, requiring the agent to have shell execution capabilities.
[REMOTE_CODE_EXECUTION]: The call.mjs script performs dynamic runtime imports of external packages including @x402/fetch, @x402/evm, and viem. Additionally, the script contains a self-integrity check that fetches a remote hash from the vendor's server and compares it to its own local hash, potentially blocking execution based on remote state.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from a remote API which is then processed by the agent.
Ingestion points: The JSON response from the fittings.sh lookup endpoint containing diagnosis descriptions.
Boundary markers: None present in the script output to delimit API data from instructions.
Capability inventory: Shell command execution and network access for payment processing.
Sanitization: No explicit sanitization or filtering of the API response is performed before it is returned to the agent context.

icd10-lookup