The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation provides instructions to download the call.mjs client script from the author's official domain (https://fittings.sh/skill/call.mjs) and execute it using Node.js to interact with the paid API endpoints.
[COMMAND_EXECUTION]: The skill instructions include standard shell commands such as curl, node, and jq to facilitate API interaction, script execution, and JSON processing. These are legitimate tools for the skill's documented functionality.
[DATA_EXPOSURE]: The skill requires a private key provided via the FITTINGS_PRIVATE_KEY environment variable to sign payment authorizations for the x402 protocol. The vendor documentation provides clear security guidance, recommending the use of throwaway wallets and explaining that signing occurs locally.
[DYNAMIC_EXECUTION]: The call.mjs script utilizes dynamic imports to load its blockchain and networking dependencies (viem, @x402/fetch). Additionally, it performs a self-integrity check by hashing its own content and comparing it against a remote value from the vendor's site before proceeding with paid calls.
[INDIRECT_PROMPT_INJECTION]: The skill fetches external financial data from Treasury reporting endpoints.
Ingestion points: Data is retrieved from the https://fittings.sh/v1/treasury/reporting-rate endpoint.
Boundary markers: None; the response is handled as raw structured data (JSON).
Capability inventory: The skill possesses network retrieval capabilities and local file system read access for integrity checks.
Sanitization: The client script acts as a conduit for the Treasury data, which is provided in a standard structured format without additional sanitization layers.

treasury-reporting-rate