The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file provides instructions to execute a Node.js script (call.mjs) to interact with the API. This is the intended primary purpose of the skill and is documented for the user.
[EXTERNAL_DOWNLOADS]: The skill mentions downloading call.mjs via curl from https://fittings.sh/skill/call.mjs. As this is the official domain of the skill author (fittings-sh), this is considered a safe vendor-provided resource.
[DATA_EXPOSURE]: The skill requires the user to set an environment variable FITTINGS_PRIVATE_KEY for making paid requests. The documentation correctly advises using a throwaway wallet with minimal funds and warns that the key is stored in plaintext where the agent runs, which follows security best practices for this type of operation.
[REMOTE_CODE_EXECUTION]: The call.mjs script dynamically imports several packages (@x402/fetch, @x402/evm, viem). These are standard dependencies for the x402 protocol and Ethereum interactions and are fetched from the official NPM registry.
[COMMAND_EXECUTION]: The call.mjs script performs a self-integrity check by hashing its own content and comparing it against a hash fetched from https://fittings.sh/skill/call.mjs.sha256. This is a safety feature to prevent the use of outdated or mismatched payment logic.

water-usgs-streamflow