The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the user to set a FITTINGS_PRIVATE_KEY environment variable containing a wallet's private key. Storing sensitive cryptographic keys in environment variables is an unsafe practice as they may be exposed to other processes, system logs, or debugging outputs.
[EXTERNAL_DOWNLOADS]: The SKILL.md file explicitly instructs the user to download an external script (call.mjs) from https://fittings.sh/skill/call.mjs if the file is missing. This encourages the execution of code fetched from a remote source at runtime.
[REMOTE_CODE_EXECUTION]: The included call.mjs script implements a self-integrity check that fetches a hash from https://fittings.sh/skill/call.mjs.sha256 and compares it to its own local hash. If they do not match, the script refuses to run and directs the user to download and execute an updated version of the script from the remote server, effectively acting as a remote update mechanism.
[COMMAND_EXECUTION]: The skill's operational flow relies on the agent or user executing node call.mjs with command-line arguments. This script handles network communication, cryptographic signing, and transaction facilitation with the vendor's API.
[INDIRECT_PROMPT_INJECTION]: The skill processes external text inputs (a and b) which are interpolated into a JSON payload for a network request to https://fittings.sh/v1/text/similarity. While the data is passed through JSON.stringify, the skill lacks explicit boundary markers or instructions to the LLM to ignore potentially malicious instructions embedded within the text records being compared.

text-similarity