The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The instructions direct users to download a JavaScript file (call.mjs) from a remote URL (https://fittings.sh/skill/call.mjs) and execute it using node. This mechanism facilitates the execution of arbitrary code sourced from an external domain.
[COMMAND_EXECUTION]: The skill documentation includes shell commands for downloading external content and executing scripts that interact with environment variables and local system resources.
[CREDENTIALS_UNSAFE]: The skill instructs users to export a private key (FITTINGS_PRIVATE_KEY) as a plaintext environment variable. While the documentation suggests using a 'throwaway' wallet, this practice exposes sensitive cryptographic keys to the environment and any processes capable of reading environment variables.
[EXTERNAL_DOWNLOADS]: The skill performs multiple network requests to fittings.sh to fetch schemas and executable scripts, introducing a dependency on the availability and integrity of an external third-party server.
[INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from an external API (api.nhtsa.gov via the fittings.sh gateway), which represents an ingestion surface for untrusted content.
Ingestion points: GET https://fittings.sh/v1/nhtsa/safety-ratings (processed in SKILL.md)
Boundary markers: None identified in the provided instructions.
Capability inventory: File downloads (curl), shell command execution, and script execution (node).
Sanitization: No explicit sanitization or validation of the remote API response is documented.

fittings-nhtsa-safety-ratings