The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation provides instructions to download a JavaScript file (call.mjs) from the author's domain (https://fittings.sh/skill/call.mjs) and execute it locally using node. This script is used to communicate with the hashing API and handle payment signing.- [EXTERNAL_DOWNLOADS]: The skill uses curl to fetch catalog metadata and the execution client (call.mjs) from the vendor's infrastructure at fittings.sh.- [CREDENTIALS_UNSAFE]: Users are instructed to set the FITTINGS_PRIVATE_KEY environment variable with an Ethereum private key to sign payment authorizations. Although the skill advises using a throwaway wallet, this practice results in sensitive credentials being stored in plaintext within the environment.- [COMMAND_EXECUTION]: The skill utilizes shell commands (curl, node, export) to configure the environment, download resources, and execute the hashing tool.- [INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion point for arbitrary text meant for hashing, which creates a surface for indirect prompt injection findings.
Ingestion points: The text parameter in the POST request defined in SKILL.md.
Boundary markers: No delimiters or instructions to ignore embedded content are provided in SKILL.md.
Capability inventory: The skill involves network access via curl and script execution via node (as described in SKILL.md), including the ability to sign blockchain transactions.
Sanitization: No input validation or sanitization mechanisms are specified in the provided documentation.

fittings-crypto-hash-digest