The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file suggests using node call.mjs to execute queries and manage payments. This is a standard execution pattern for the skill's provided functionality.
[EXTERNAL_DOWNLOADS]: The skill mentions fetching an updated version of its client script using curl -sO https://fittings.sh/skill/call.mjs. This download targets the vendor's official domain (fittings.sh) and is intended for legitimate software updates.
[CREDENTIALS_UNSAFE]: The skill uses an environment variable FITTINGS_PRIVATE_KEY to manage a wallet's private key. The documentation follows security best practices by explicitly warning users to use a 'throwaway wallet' and not their main credentials, acknowledging the risk of storing keys in plaintext.
[DATA_EXFILTRATION]: While the skill transmits a signature (derived from a private key) to a remote server (fittings.sh), this is the core mechanism of the x402 payment protocol required for the service. There is no evidence of unauthorized data harvesting or exfiltration to third-party domains.

kev-recent