The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs users to export a sensitive private key (FITTINGS_PRIVATE_KEY) into the environment. This key is used for blockchain transactions and is stored in plaintext where it can be accessed by scripts or other processes in the agent's environment.
[EXTERNAL_DOWNLOADS]: The instructions command the download of an external JavaScript file (call.mjs) from https://fittings.sh/skill/call.mjs using curl.
[REMOTE_CODE_EXECUTION]: The skill guides the user to execute the downloaded call.mjs script using node, allowing code from a remote server to run with the permissions of the local environment and access to environment variables.
[COMMAND_EXECUTION]: The skill uses multiple shell commands (curl, node, export) to interact with the API and manage local state.
[PROMPT_INJECTION]: The skill processes a user-provided ticker string and interpolates it directly into a shell command for execution.
Ingestion points: The ticker argument in the node call.mjs command line.
Boundary markers: None identified.
Capability inventory: Network access via curl and JavaScript execution via node.
Sanitization: No validation or escaping of the ticker input is documented.

fittings-sec-ticker-resolve