The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions and code utilize the FITTINGS_PRIVATE_KEY environment variable to sign payment authorizations. Although the documentation explicitly warns users to use a throwaway wallet and only keep necessary funds in it, the management of private keys within an agent's environment represents a significant security responsibility.
[EXTERNAL_DOWNLOADS]: The SKILL.md file suggests fetching the call.mjs execution script from https://fittings.sh/skill/call.mjs if it is missing. This introduces a remote dependency on the vendor's infrastructure for the skill's logic.
[COMMAND_EXECUTION]: The skill facilitates the execution of local shell commands and Node.js scripts (node call.mjs) to perform data queries and blockchain-based payment handshakes.
[DATA_EXFILTRATION]: The execution script transmits request metadata and cryptographic signatures to the vendor's domain (fittings.sh) to facilitate paid API calls.
[REMOTE_CODE_EXECUTION]: The skill uses dynamic imports in call.mjs to load dependencies such as @x402/fetch, @x402/evm, and viem to handle the payment logic at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill ingests earthquake data from the USGS (via a proxy) into the agent's context.
Ingestion points: API responses fetched by call.mjs (data from fittings.sh).
Boundary markers: None explicitly implemented in the provided scripts to separate raw data from agent instructions.
Capability inventory: The skill has network access and the ability to execute code via node.
Sanitization: The script uses JSON.parse for response data but does not perform content-level sanitization of the earthquake descriptions.

quake-usgs-events