The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references external resources hosted on fittings.sh, including documentation and a logic script (call.mjs) for handling payments. It also specifies dependencies on Node.js packages @x402/core and @x402/evm for settlement logic.
[CREDENTIALS_UNSAFE]: The skill documentation advises the use of a FITTINGS_PRIVATE_KEY environment variable to authorize payments. It explicitly mentions that this key is stored in plaintext within the agent's execution environment, which could lead to exposure if the environment is compromised.
[DATA_EXFILTRATION]: The skill transmits user-supplied street addresses to an external service at fittings.sh. While this is the intended purpose of the geocoding service, it involves sending potentially sensitive location information to a third party.
[INDIRECT_PROMPT_INJECTION]: The skill processes free-form address strings provided by the user, which represents an attack surface for indirect prompt injection.
Ingestion points: The addresses array in the JSON request body.
Boundary markers: None identified in the provided instructions.
Capability inventory: The skill utilizes curl for network communication and payment authorization.
Sanitization: No explicit sanitization or validation of the input strings is described.

fittings-census-geocode-batch