The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads a JavaScript client file (call.mjs) directly from the vendor's domain at https://fittings.sh/skill/call.mjs to facilitate the interaction with the weather API gateway.\n- [REMOTE_CODE_EXECUTION]: The instructions direct the execution of the downloaded script via node call.mjs. While this executes remote code at runtime, the source is the official domain of the skill author and is necessary for the tool's core functionality.\n- [COMMAND_EXECUTION]: The skill uses shell commands like curl to fetch the catalog and the client script, and node to process the weather queries.\n- [CREDENTIALS_UNSAFE]: The documentation instructs the user to set a FITTINGS_PRIVATE_KEY environment variable. This stores a sensitive cryptographic private key used to sign transactions for the x402 payment protocol.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied latitude and longitude coordinates and interpolates them into a shell command line.\n
Ingestion points: lat and lon arguments in the node call.mjs command string.\n
Boundary markers: No explicit delimiters or guardrails are present in the command invocation logic.\n
Capability inventory: Network access via curl, file system write via curl -sO, and arbitrary JavaScript execution via node.\n
Sanitization: The instructions do not define specific validation or escaping mechanisms for the coordinate inputs.

fittings-nws-current-conditions