The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation instructs the agent to download a JavaScript file (call.mjs) from https://fittings.sh/skill/call.mjs and execute it using node. This involves runtime fetching and execution of remote code.
[CREDENTIALS_UNSAFE]: The skill requires the user to set a blockchain private key in the FITTINGS_PRIVATE_KEY environment variable. While the instructions advise using a throwaway wallet, this pattern of handling private keys in plaintext environment variables poses a risk of credential exposure if the execution environment is monitored or the downloaded script is compromised.
[COMMAND_EXECUTION]: The skill utilizes shell commands (curl, node, export) to interact with the vendor's infrastructure and manage execution state.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided drug names and FDA application numbers, which are used to construct external API requests. The data returned from the remote service (sourced from openFDA) is then processed by the agent.
Ingestion points: User input for drug and application parameters; external API responses from fittings.sh.
Boundary markers: None identified in the provided documentation to distinguish between instructional data and API content.
Capability inventory: The skill uses curl and node to perform network operations and execute scripts.
Sanitization: No explicit sanitization or validation of the remote API response or user input is described.

fittings-orangebook-therapeutic-equivalence