The Agent Skills Directory

[PROMPT_INJECTION]: The skill facilitates the retrieval of full-text SEC filings and other regulatory records, which represents an indirect prompt injection surface if the external data contains malicious instructions designed to influence the agent's behavior.
Ingestion points: External data enters the agent context via sec.filing-search (full-text search of SEC filings), lei.search (legal entity identification data), and vat.eu-validate (European VIES registry data).
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" prompts to wrap the content retrieved from the fittings.sh API.
Capability inventory: The skill uses node scripts/call.mjs for transaction signing and API interaction, and curl for metadata retrieval.
Sanitization: No explicit sanitization or filtering of the retrieved content is described before the data is processed by the agent.
[COMMAND_EXECUTION]: The skill requires the execution of a local Node.js script and standard shell commands to function.
Evidence: The skill instructs the agent to use node scripts/call.mjs to perform API calls and curl to fetch the service catalog from the vendor endpoint.
[EXTERNAL_DOWNLOADS]: The skill fetches financial and regulatory reference data from the vendor's API.
Evidence: Queries are sent to https://fittings.sh for SEC Edgar data, LEI records, and exchange rates. This is a vendor-owned resource associated with the skill author.

fittings-finance