The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation describes fetching a helper script from https://fittings.sh/skill/call.mjs and installing multiple Node.js packages from the npm registry, which are necessary for the skill's payment and network functions.\n- [CREDENTIALS_UNSAFE]: The skill operations depend on the FITTINGS_PRIVATE_KEY environment variable. The instructions suggest providing a raw Ethereum private key, which is then processed by the call.mjs script in the local environment to sign transactions.\n- [DATA_EXFILTRATION]: The call.mjs script uses the provided private key to sign payment challenges. These signatures are sent to the fittings.sh gateway to authorize payments, involving the transmission of data derived from sensitive credentials to an external endpoint.\n- [REMOTE_CODE_EXECUTION]: The skill downloads its primary execution script, call.mjs, from the vendor's domain and runs it locally using Node.js. It also dynamically imports libraries such as @x402/fetch and viem at runtime to handle payment logic.\n- [COMMAND_EXECUTION]: The skill relies on shell commands to run the call.mjs Node.js script and to fetch the script via curl. It also performs an integrity check by hashing its own content and comparing it with a value fetched from the vendor's server.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests weather alert data from the National Weather Service via a third-party gateway. This represents a potential attack surface where external data enters the agent's context, although the risk is limited by the specific nature of weather alert information.

nws-area-alerts