The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the FITTINGS_PRIVATE_KEY environment variable to be set with a blockchain private key. The instructions explicitly acknowledge that the key is stored in plaintext wherever the agent runs, creating a high risk of credential exposure and theft if the environment is compromised.
[EXTERNAL_DOWNLOADS]: The skill instructions direct the user to download a script (call.mjs) from a remote server (https://fittings.sh/skill/call.mjs) using curl. While this originates from the vendor's domain, it introduces an external dependency that is executed locally.
[COMMAND_EXECUTION]: The skill provides commands for the agent to execute shell operations, including downloading external files and running Node.js scripts that perform network requests and cryptographic signing.
[REMOTE_CODE_EXECUTION]: The helper script call.mjs dynamically imports several Node.js packages (@x402/fetch, @x402/evm, viem) and executes logic based on responses from a remote API, including handling payment handshakes and re-executing requests with signed authorizations.
[DATA_EXPOSURE]: The skill transmits package manifest data (up to 64KB) to an external endpoint (fittings.sh). While this is the intended functionality, users should be aware that the content of the package.json is sent to a third-party service.

pkg-normalize-manifest