The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a utility script from the vendor's domain at https://fittings.sh/skill/call.mjs using curl.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to run the downloaded script (call.mjs) using the node runtime.
[COMMAND_EXECUTION]: The skill uses shell commands, including curl, jq, and node, to download resources, query the catalog, and execute payments.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection via external weather data.
Ingestion points: Real-time National Weather Service alerts are retrieved from https://fittings.sh/v1/nws/area-alerts and processed by the agent.
Boundary markers: There are no delimiters or instructions provided to the agent to treat the external data as untrusted or to ignore embedded instructions.
Capability inventory: The agent has access to shell command execution (node, curl) which could be targeted by a malicious payload in the alert data.
Sanitization: No validation or sanitization of the incoming alert content is performed before presentation to the agent.

fittings-nws-area-alerts