The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the user to provide a blockchain private key via the FITTINGS_PRIVATE_KEY environment variable. The call.mjs script uses this key with the viem library to sign payment authorizations. Storing sensitive credentials in plaintext within an agent's execution context is a high-risk practice, as they can be exposed through prompt injection, error logs, or environment inspection.
[COMMAND_EXECUTION]: The skill includes a Node.js utility script (call.mjs) designed to be executed from the shell. This script handles network communication and cryptographic signing to interact with the Fittings service.
[REMOTE_CODE_EXECUTION]: The call.mjs script performs dynamic imports of libraries such as @x402/fetch, @x402/evm, and viem. Additionally, it includes an integrity check that fetches a remote hash from https://fittings.sh/skill/call.mjs.sha256, which could potentially be used to gate execution or verify remote payloads.
[EXTERNAL_DOWNLOADS]: The documentation suggests downloading the helper script directly from https://fittings.sh/skill/call.mjs using curl, which bypasses managed dependency chains and versioning controls.
[PROMPT_INJECTION]: The skill fetches external content (astronomy picture explanations) from NASA via the Fittings API. This content is processed by the agent without explicit boundary markers or sanitization, creating a surface for potential indirect prompt injection attacks where malicious instructions could be embedded in the fetched data.

nasa-astronomy-picture