The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to download a JavaScript file (call.mjs) from an external vendor-controlled domain at https://fittings.sh/skill/call.mjs using curl.
[REMOTE_CODE_EXECUTION]: The skill executes the downloaded call.mjs script using the node runtime. This pattern represents the execution of remote code that is not bundled with the skill, allowing for dynamic updates to the execution logic without user review.
[COMMAND_EXECUTION]: The skill utilizes shell commands including curl for network requests and node for executing the client logic and processing blockchain authorizations.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external earthquake catalogs (USGS) which could be used as a vector for indirect injection if the processed content is not properly sanitized.
Ingestion points: External earthquake event data retrieved from the /v1/quake/recent endpoint.
Boundary markers: None; the skill does not specify markers to delimit the retrieved data from the agent's instructions.
Capability inventory: The skill has the ability to execute shell commands (curl, node, jq) and write files to the local disk.
Sanitization: The instructions do not describe any sanitization or validation mechanisms for the structured JSON data returned by the API.

fittings-quake-recent