The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads a client script from https://fittings.sh/skill/call.mjs. This resource belongs to the skill's author domain and is used to facilitate API communication.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute the downloaded call.mjs script using node. This script handles the signing of payment authorizations and the communication with the HTS search endpoint.
[COMMAND_EXECUTION]: The skill utilizes shell commands (curl and node) to download the client and perform searches. It also requires setting an environment variable (FITTINGS_PRIVATE_KEY) for paid operations.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data via the query parameter, which is then interpolated into a shell command.
Ingestion points: The query argument in the search command, taken from user product descriptions.
Boundary markers: The provided example uses double quotes to delimit the query string.
Capability inventory: The skill can perform network requests (curl), execute local scripts (node), and access environment variables.
Sanitization: Validation and escaping of the query input are handled by the external call.mjs script rather than the skill instructions.

fittings-hts-search