The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation includes a command to fetch a helper script from the vendor's domain (https://fittings.sh/skill/call.mjs) using curl if it is not already present. This is part of the vendor's distribution mechanism.
[CREDENTIALS_UNSAFE]: The skill utilizes an environment variable (FITTINGS_PRIVATE_KEY) to hold a wallet private key for authorizing payments. The documentation follows security best practices by warning users to use a dedicated low-value wallet and explicitly noting the risks of plaintext key storage in the environment.
[COMMAND_EXECUTION]: The skill's primary functionality is delivered through a Node.js script (call.mjs) which must be executed by the agent to perform the screening calls and handle the payment handshake.
[REMOTE_CODE_EXECUTION]: The provided client script includes an integrity check that fetches a SHA256 hash from the vendor's server to verify that the local script is up to date before signing payment authorizations.

pep-wikidata-screen