The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions direct the user to download a JavaScript file (call.mjs) from the vendor's server and execute it locally using Node.js.
Evidence: curl -sO https://fittings.sh/skill/call.mjs followed by node call.mjs cve.lookup id=CVE-2021-44228.
[EXTERNAL_DOWNLOADS]: The skill fetches both configuration data and executable code from the vendor's domain.
Evidence: Fetches catalog metadata from https://fittings.sh/catalog/cve.lookup and the execution client from https://fittings.sh/skill/call.mjs.
[COMMAND_EXECUTION]: The instructions rely on shell commands to interact with the service and execute the payment logic.
Evidence: Use of curl, jq, and node within the documented workflows.
[CREDENTIALS_UNSAFE]: The skill requires the user to provide a blockchain private key via an environment variable to authorize payments for API usage.
Evidence: export FITTINGS_PRIVATE_KEY=0x.... The skill includes a specific warning: "The key sits in plaintext wherever the agent runs... Use a throwaway wallet holding a few dollars, not a main one."
[PROMPT_INJECTION]: The skill processes CVE data retrieved from the National Vulnerability Database (NVD), which is an external, third-party data source.
Ingestion points: CVE descriptions and references are fetched from https://fittings.sh/v1/cve/lookup.
Boundary markers: No specific delimiters are used to wrap the external content to prevent the agent from following potential instructions inside CVE descriptions.
Capability inventory: The skill has access to network tools (curl) and script execution (node).
Sanitization: No explicit sanitization of the NVD data is described.

fittings-cve-lookup