The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation instructs users to download the implementation script call.mjs directly from the vendor's website if it is missing.
Evidence: curl -sO https://fittings.sh/skill/call.mjs in SKILL.md.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of a downloaded Node.js script (call.mjs) which performs network operations and cryptographic signing.
Evidence: Users are instructed to run node call.mjs pkg-name-check ... after downloading the script.
[DYNAMIC_EXECUTION]: The helper script uses dynamic imports to load several external libraries for blockchain interaction and HTTP payment handling.
Evidence: await import('@x402/fetch'), await import('@x402/evm/exact/client'), and await import('viem') in call.mjs.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge to a remote API, creating an ingestion surface where the agent processes external, untrusted data.
Ingestion points: API responses fetched from https://fittings.sh/v1/pkg/name-check are parsed and printed to standard output.
Boundary markers: None; the raw JSON or text response is returned directly to the agent's context.
Capability inventory: The script has capabilities for network access (fetch), environment variable access (process.env.FITTINGS_PRIVATE_KEY), and local file reading (readFileSync).
Sanitization: The script performs basic JSON parsing but does not sanitize the content of the API response before it is displayed.
[DATA_EXPOSURE]: The skill is designed to handle a sensitive Ethereum private key stored in an environment variable to authorize payments.
Evidence: const KEY = process.env.FITTINGS_PRIVATE_KEY is used in call.mjs to create a wallet account for signing transactions.

pkg-name-check