The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions and call.mjs script require the user to set FITTINGS_PRIVATE_KEY in their environment variables. While the documentation suggests using a 'throwaway wallet', storing a raw private key in the shell environment is a significant security risk, as it may be accessible to other processes or recorded in shell history.
[EXTERNAL_DOWNLOADS]: The SKILL.md file explicitly instructs users to fetch the main execution logic from a remote server using curl -sO https://fittings.sh/skill/call.mjs if the file is not present. This introduces a risk of executing unverified code from an external source.
[REMOTE_CODE_EXECUTION]: The call.mjs script uses dynamic import() to load several external libraries, including @x402/fetch, @x402/evm, and viem. Furthermore, it fetches a SHA-256 hash from a remote server (https://fittings.sh/skill/call.mjs.sha256) to verify its own integrity, creating a dependency on the availability and integrity of the vendor's remote infrastructure at runtime.
[COMMAND_EXECUTION]: The skill operates by executing shell commands (node call.mjs ...) that process user-provided arguments and perform network operations, including signing cryptographic challenges and sending them to a remote API.

quake-nearby