The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions provide a command to fetch an external JavaScript file (call.mjs) from the vendor's domain https://fittings.sh/skill/call.mjs using curl.- [REMOTE_CODE_EXECUTION]: The skill requires the execution of the downloaded call.mjs script using the node runtime. This allows for the execution of remote code that is not part of the skill's static distribution.- [CREDENTIALS_UNSAFE]: The documentation instructs the agent or user to export a private key (FITTINGS_PRIVATE_KEY) as a plaintext environment variable. While the skill suggests using a throwaway wallet, providing private keys in this manner exposes sensitive credentials to the runtime environment.- [COMMAND_EXECUTION]: The skill relies on shell commands for its operations, including curl for network requests, node for executing downloaded scripts, and export for setting environment variables.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the NPPES NPI Registry, which constitutes a surface for indirect prompt injection if external registry data contains malicious instructions that are not properly sanitized before being processed by the agent.
Ingestion points: Provider data retrieved from https://fittings.sh/v1/npi/provider-lookup.
Boundary markers: None identified in the skill instructions.
Capability inventory: Ability to execute shell commands and run JavaScript via node.
Sanitization: No sanitization or data validation methods are described in the provided text.

fittings-npi-provider-lookup