The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct the download of a payment client script (call.mjs) from the vendor's domain fittings.sh using curl.
[REMOTE_CODE_EXECUTION]: The skill instructs the execution of the downloaded call.mjs script using node. This script interacts with the vendor's gateway to sign and settle payments for API usage.
[CREDENTIALS_UNSAFE]: The skill requires the user to provide a sensitive cryptocurrency private key via the FITTINGS_PRIVATE_KEY environment variable. The documentation explicitly notes that this key is stored in plaintext in the execution environment.
[COMMAND_EXECUTION]: Several shell commands are provided for execution, including curl for fetching remote files and node for running the downloaded client script.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied search queries that are passed to an external API, creating a surface for indirect injection if results are later processed by the agent without sanitization.
Ingestion points: The query parameter in the bibliographic search endpoint.
Boundary markers: None provided in the instruction schema.
Capability inventory: Shell command execution (node, curl) and network operations.
Sanitization: No explicit sanitization or filtering of API responses is mentioned.

fittings-crossref-search