The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill downloads an external JavaScript file (call.mjs) from https://fittings.sh/skill/call.mjs and executes it using the Node.js runtime (node call.mjs). This allows the execution of code not contained within the skill's source files.
[EXTERNAL_DOWNLOADS]: The skill uses curl to fetch external resources, including a schema from https://fittings.sh/catalog/epa.carbon-estimate and the executable script https://fittings.sh/skill/call.mjs from the vendor's infrastructure.
[CREDENTIALS_UNSAFE]: The documentation instructs the agent or user to export a sensitive private key (FITTINGS_PRIVATE_KEY) as a plaintext environment variable. While it advises using a throwaway wallet, storing raw private keys in environment variables is a high-risk credential management practice.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data (activity, mode, quantity) as arguments for the Node.js script and sends them to an external API.
Ingestion points: CLI arguments passed to node call.mjs and eventually to the fittings.sh API.
Boundary markers: None identified in the instructional text.
Capability inventory: File download (curl), shell command execution (node), and network communication via the downloaded script.
Sanitization: No explicit sanitization or validation of the input parameters is described in the instructions.

fittings-epa-carbon-estimate