The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions direct the user to download a JavaScript file (call.mjs) from the vendor's domain (fittings.sh) and execute it locally using node.
[CREDENTIALS_UNSAFE]: The documentation instructs users to provide a blockchain private key via the FITTINGS_PRIVATE_KEY environment variable for payment settlement. The skill explicitly states that this key will be stored in plaintext within the environment where the agent runs, posing a risk of credential exposure.
[EXTERNAL_DOWNLOADS]: The skill uses curl to fetch an external script from https://fittings.sh/skill/call.mjs to facilitate API calls.
[COMMAND_EXECUTION]: The skill relies on shell commands including curl, node, and export to manage the lifecycle of the arithmetic evaluation and payment process.
[INDIRECT_PROMPT_INJECTION]: The skill processes an expression parameter provided by the user, which serves as an ingestion point for untrusted data that is passed to a remote service and handled by a script with execution capabilities.
Ingestion points: The expression field in the API request (SKILL.md).
Boundary markers: Not present.
Capability inventory: The skill utilizes network access via curl and executes downloaded code via node (SKILL.md).
Sanitization: No sanitization or validation logic for the input expression is defined within the skill documentation.

fittings-calc-evaluate