The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the user to store a sensitive blockchain private key in an environment variable to authorize payments for data access.
Evidence: The instruction export FITTINGS_PRIVATE_KEY=0x... in SKILL.md exposes the key in plaintext to the shell environment and process monitoring tools.
[EXTERNAL_DOWNLOADS]: The skill initiates downloads from the vendor's domain for both execution logic and integrity verification.
Evidence: SKILL.md instructs users to download the call.mjs script using curl -sO https://fittings.sh/skill/call.mjs.
Evidence: The call.mjs script fetches a remote SHA256 hash from https://fittings.sh/skill/call.mjs.sha256 to verify its own integrity at runtime.
[REMOTE_CODE_EXECUTION]: The skill lifecycle involves fetching and executing remote code within the local user context.
Evidence: The agent is instructed to run the downloaded JavaScript client using node call.mjs, which performs network-based payment handshakes and cryptographic operations.
[COMMAND_EXECUTION]: The skill relies on several shell commands to configure its environment and process service data.
Evidence: The documentation includes instructions for using export, node, curl, and jq to interact with the API and handle the blockchain-based payment flow.

nasa-power-point