The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the user to provide a FITTINGS_PRIVATE_KEY as an environment variable to authorize payments for the service. The documentation acknowledges that the key is stored in plaintext and recommends using a throwaway wallet, but storing private keys in environment variables remains a sensitive practice due to potential exposure in logs or to other system processes.
[EXTERNAL_DOWNLOADS]: The skill instructions suggest downloading a helper script, call.mjs, from the vendor's domain using curl -sO https://fittings.sh/skill/call.mjs. While the domain belongs to the skill author, downloading and executing external scripts is a common vector for supply chain risks.
[COMMAND_EXECUTION]: The core functionality of the skill relies on executing a local Node.js script (call.mjs) that processes user-supplied command-line arguments to build and sign network requests.
[DATA_EXFILTRATION]: The call.mjs script performs network requests to the vendor's API (fittings.sh) and sends cryptographic signatures derived from the user's private key to facilitate payments. This is the intended behavior of the skill but involves transmitting sensitive signing data to a remote endpoint.

sec-company-facts