The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references a remote JavaScript file https://fittings.sh/skill/call.mjs which is used to manage payment handshakes for metered API calls.
[CREDENTIALS_UNSAFE]: The documentation describes the use of a FITTINGS_PRIVATE_KEY environment variable for signing transactions and explicitly warns users that this key is stored in plaintext within the execution environment.
[COMMAND_EXECUTION]: The skill provides curl command examples to query the API and process responses, including handling 402 Payment Required responses and retrying with payment signatures.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted JSON data provided in the records field to generate schemas, which represents an indirect injection surface.
Ingestion points: The records array passed to the https://fittings.sh/v1/schema/infer endpoint.
Boundary markers: The skill does not define specific delimiters or warnings to ignore instructions embedded within the record data.
Capability inventory: The skill performs network operations via curl to the vendor's domain.
Sanitization: There is no mention of sanitization or validation performed on the input records before processing.

fittings-schema-infer