The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires a blockchain private key to be stored in the FITTINGS_PRIVATE_KEY environment variable to authorize payments for the service. Storing private keys in environment variables is a risk as they can be exposed through system logs or shared environment access.\n
Evidence: SKILL.md instructions suggest export FITTINGS_PRIVATE_KEY=0x... and call.mjs accesses it via process.env.FITTINGS_PRIVATE_KEY.\n- [EXTERNAL_DOWNLOADS]: The instructions suggest downloading a Node.js helper script directly from the vendor's domain using curl.\n
Evidence: curl -sO https://fittings.sh/skill/call.mjs in SKILL.md.\n- [COMMAND_EXECUTION]: The skill involves the execution of a local script (call.mjs) to perform API calls and cryptographic signing.\n
Evidence: User instructions to run node call.mjs time.business-days ....\n- [REMOTE_CODE_EXECUTION]: The helper script call.mjs dynamically imports cryptographic and networking libraries from npm registries at runtime.\n
Evidence: Dynamic import() calls for @x402/fetch, @x402/evm, and viem libraries.\n- [PROMPT_INJECTION]: The skill processes user-supplied date and number inputs, creating a surface for potential indirect prompt injection if those values originate from untrusted sources.\n
Ingestion points: The date, days, and holidays arguments in SKILL.md and call.mjs.\n
Boundary markers: None present to delimit user data from processing logic.\n
Capability inventory: The skill can perform network requests to the vendor API and sign payment authorizations.\n
Sanitization: The parseArgs function in call.mjs performs basic type coercion (e.g., converting strings to numbers), which provides a minimal layer of validation.

time-business-days