The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the configuration of an EVM private key in the FITTINGS_PRIVATE_KEY environment variable. The documentation acknowledges that this key is stored in plaintext within the environment where the agent runs and recommends using a throwaway wallet due to the inherent risk of key exposure.
[EXTERNAL_DOWNLOADS]: The instructions describe fetching the call.mjs script directly from https://fittings.sh/skill/call.mjs. Additionally, the script performs a runtime integrity check by fetching a SHA256 hash from https://fittings.sh/skill/call.mjs.sha256 to ensure the local version matches the gateway version.
[COMMAND_EXECUTION]: The call.mjs script executes network requests and cryptographic signing operations. It acts as a client that interacts with external services to settle payments for API calls.
[DYNAMIC_EXECUTION]: The script uses dynamic import() statements to load external dependencies such as @x402/fetch, @x402/evm, and viem libraries at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied input through CLI arguments which are interpolated into API requests.
Ingestion points: Command-line arguments parsed by call.mjs and used as query parameters or JSON body fields.
Boundary markers: None identified in the script or prompt interpolation.
Capability inventory: Includes network access via fetch, file system reading via readFileSync, and cryptographic signing.
Sanitization: The parseArgs function performs basic type coercion (number, boolean, array, object) based on the service schema, but string inputs are passed directly to the request.

usda-food-search