The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads a JavaScript file (call.mjs) from the vendor's domain at https://fittings.sh/skill/call.mjs to facilitate API interactions.
[REMOTE_CODE_EXECUTION]: The downloaded script is executed directly using the Node.js runtime (node call.mjs), creating a dependency on the integrity of the remote vendor's infrastructure at execution time.
[CREDENTIALS_UNSAFE]: The skill instructs users to store a blockchain private key in an environment variable (FITTINGS_PRIVATE_KEY). While the documentation suggests using a throwaway wallet, this exposes credentials to the local environment and the executed script.
[COMMAND_EXECUTION]: The skill uses shell commands (curl, node, export) to fetch remote code and execute the geocoding logic.
[INDIRECT_PROMPT_INJECTION]: The skill accepts free-form address data as input to the address field. This represents an injection surface if the data is sourced from untrusted external entities, as it is processed by the geocoding service and the execution script.
Ingestion points: The address parameter in the GET request to fittings.sh/v1/geo/forward-geocode and the node call.mjs command arguments.
Boundary markers: None identified in the provided instructions.
Capability inventory: File system writing (via curl -O), network access (via curl), and arbitrary command execution (via node).
Sanitization: No explicit sanitization or validation of the input address string is documented in the skill instructions.

fittings-geo-forward-geocode