The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the user to provide a blockchain private key through the FITTINGS_PRIVATE_KEY environment variable for authenticated API calls. The documentation correctly warns that this practice stores the key in plaintext within the execution environment.
[EXTERNAL_DOWNLOADS]: The skill instructions direct users to download an execution script (call.mjs) from the author's domain at fittings.sh to facilitate the payment handshake and API interaction.
[COMMAND_EXECUTION]: The provided call.mjs script performs network operations, cryptographic signing, and local file reads. It includes a self-integrity check that compares its own SHA-256 hash against a remote value on the vendor's server to verify the script version.
[PROMPT_INJECTION]: The skill processes external data (LEIs) that is subsequently used in network requests and agent decision-making, representing an indirect injection surface.
Ingestion points: The lei parameter in SKILL.md and command-line arguments processed in call.mjs.
Boundary markers: There are no specific delimiters or instruction-bypass warnings used when interpolating these identifiers into the API requests.
Capability inventory: The skill can perform network requests (fetch), read its own source code (readFileSync), and generate cryptographic signatures using the viem library.
Sanitization: Input data is coerced according to the service schema and encoded via standard URL-encoding or JSON-stringification before transmission.

valid-lei