The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file provides shell commands using curl, jq, and node to interact with the API and the included call.mjs script. These are standard developer interactions for this type of service.
[EXTERNAL_DOWNLOADS]: The skill mentions downloading a missing helper script via curl -sO https://fittings.sh/skill/call.mjs. This is a vendor-owned resource (fittings.sh) and is considered safe within the context of the skill's functionality.
[COMMAND_EXECUTION]: The call.mjs script executes as a Node.js process and uses standard libraries to perform network requests (fetch) and handle crypto operations. It does not perform unauthorized system modifications or privilege escalation.
[CREDENTIALS_SAFE]: The skill uses an environment variable FITTINGS_PRIVATE_KEY for payment. The documentation explicitly advises users to use a throwaway wallet with minimal funds and warns that the key is stored in plaintext where the agent runs, showing transparent security communication.

valid-iban