The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation instructs the agent to download a JavaScript file (call.mjs) directly from https://fittings.sh/skill/call.mjs and execute it using node. This pattern facilitates the execution of arbitrary remote code in the local environment.
[CREDENTIALS_UNSAFE]: The skill requires the user to set a private wallet key (FITTINGS_PRIVATE_KEY) as an environment variable for use by the downloaded script. The documentation explicitly warns that this key is stored in plaintext and recommends using a "throwaway wallet," acknowledging the inherent risk of credential theft or loss.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch executable code (call.mjs) and configuration data from the vendor's domain (fittings.sh).
[COMMAND_EXECUTION]: The skill instructions involve the use of shell commands (curl, node, export) to interact with the service and manage sensitive environment variables.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting data from the external EIA API through the vendor's gateway.
Ingestion points: Data enters the agent's context through the fittings.sh API responses.
Boundary markers: None identified in the skill instructions to separate external data from agent commands.
Capability inventory: The skill has the ability to execute shell commands and perform network requests.
Sanitization: There is no evidence of validation or sanitization of the remote API output before it is processed or used in downstream tasks.

fittings-eia-fuel-price