The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent or user to download a JavaScript file from https://fittings.sh/skill/call.mjs and execute it locally using node call.mjs. This allows for the execution of arbitrary code managed by a remote server.
[CREDENTIALS_UNSAFE]: The documentation explicitly tells the user to export FITTINGS_PRIVATE_KEY=0x... to enable the payment functionality. Providing a raw cryptographic private key to the environment is a high-risk practice as it gives full control over the associated wallet assets and can be easily accessed by other processes or stored in shell history.
[COMMAND_EXECUTION]: The instructions utilize shell commands (curl, node, export) to manage the installation and execution of the payment client.
[EXTERNAL_DOWNLOADS]: The skill fetches a remote settlement script (call.mjs) and queries an external catalog at https://fittings.sh/catalog/brand.logo.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process content from third-party websites (homepages and web app manifests). This represents an attack surface where malicious data on a website could attempt to influence the agent's behavior during the logo extraction process.
Ingestion points: Data is fetched from caller-supplied domain homepages and manifest files.
Boundary markers: None identified in the provided instructions.
Capability inventory: Uses network operations (curl) and shell execution (node).
Sanitization: None described for the fetched web content.

fittings-brand-logo