The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs users to download the core execution logic, call.mjs, from the vendor's domain at https://fittings.sh/skill/call.mjs. This script is executed locally using Node.js to perform both service discovery and payment-authorized API calls.- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill requires a blockchain private key provided via the FITTINGS_PRIVATE_KEY environment variable. This key is used to sign payment authorizations for API access. The skill documentation explicitly identifies this credential as sensitive and correctly advises the use of a dedicated throwaway wallet.- [DYNAMIC_EXECUTION]: The call.mjs script performs a self-integrity check by reading its own content from disk and comparing its SHA-256 hash against a version reference hosted on the vendor's server. It also uses dynamic imports to load cryptographic and network libraries required for the x402 payment protocol.- [INDIRECT_PROMPT_INJECTION]: The skill ingests nutrition data originating from the USDA FoodData Central database. While this introduces a surface for indirect instructions embedded in food descriptions, the use of a structured public record from a trusted government source significantly limits the practical risk.

usda-food-nutrients