The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches a JavaScript execution client (call.mjs) from the vendor's official domain at https://fittings.sh/skill/call.mjs to facilitate network operations.
[REMOTE_CODE_EXECUTION]: Executes the downloaded call.mjs script via node to facilitate interaction with the metadata API and handle payment logic. This is a vendor-provided script for skill functionality.
[CREDENTIALS_UNSAFE]: Instructs the user to set a blockchain private key (FITTINGS_PRIVATE_KEY) as an environment variable for paid API calls. While the documentation recommends using a throwaway wallet, providing private keys in environment variables is a security risk.
[PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection by ingesting and returning data (title, description) from arbitrary external URLs.
Ingestion points: Data is fetched from the URL provided to the url parameter in SKILL.md.
Boundary markers: No explicit boundary markers or instructions to ignore embedded content are mentioned.
Capability inventory: The skill uses curl for downloads and node for script execution.
Sanitization: The documentation does not describe any sanitization or filtering of the fetched metadata before it is processed by the agent.

fittings-doc-url-metadata