The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the user to set a sensitive environment variable FITTINGS_PRIVATE_KEY containing a blockchain private key in plaintext to facilitate USDC payments on the Base network.
[REMOTE_CODE_EXECUTION]: The skill uses a pattern where it downloads an external JavaScript file (call.mjs) from a remote server (fittings.sh) and immediately executes it using node. This pattern allows for the execution of arbitrary code fetched at runtime.
[EXTERNAL_DOWNLOADS]: The skill performs multiple network operations to fittings.sh to fetch both metadata (/catalog/semver.bump-classify) and the execution client (/skill/call.mjs).
[COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands including curl for downloading files and node for running the downloaded script.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external version strings (from and to fields) which are passed to the remote API. While these are typically short strings, they represent a data ingestion surface that is interpolated into the external call. No explicit sanitization or boundary markers for these inputs are mentioned in the provided documentation.

fittings-semver-bump-classify