The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent or user to download a remote JavaScript file (call.mjs) from https://fittings.sh/skill/call.mjs and execute it using node. This pattern allows the remote server to control the code running in the local environment.
[EXTERNAL_DOWNLOADS]: The skill fetches resources from the fittings.sh domain, including the execution client and metadata from the catalog.
[COMMAND_EXECUTION]: Instructions include the use of curl and node to interact with remote endpoints and run downloaded logic.
[CREDENTIALS_UNSAFE]: The skill requests that the user provides a private key (FITTINGS_PRIVATE_KEY) in an environment variable. While the skill claims this is for metered payments using the x402 protocol, providing a private key to a remotely fetched script is a high-risk practice.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection.
Ingestion points: External data is ingested from https://fittings.sh/v1/bls/series and https://fittings.sh/catalog/bls.series.
Boundary markers: None identified in the provided instructions.
Capability inventory: The skill uses curl for network requests and node for script execution.
Sanitization: No sanitization or validation of the remote API response is described before processing.

fittings-bls-series