The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads an external JavaScript client (call.mjs) from the vendor's domain (fittings.sh) using curl to facilitate service interactions.\n- [REMOTE_CODE_EXECUTION]: The instructions direct the agent to execute the downloaded call.mjs script using node, which constitutes remote code execution of a dynamically fetched resource.\n- [COMMAND_EXECUTION]: The skill uses shell commands, including curl for network requests and node for script execution, to interact with the SemVer resolver API and manage payment authorization.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes version strings and semver ranges provided as input. There is a potential for indirect prompt injection if the versions or ranges are sourced from untrusted external data (such as project files or user-provided strings) without sanitization.\n
Ingestion points: range and versions parameters passed via the CLI or JSON input.\n
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat input strings as non-instructional data.\n
Capability inventory: The skill possesses network access (curl) and local code execution capabilities (node).\n
Sanitization: No evidence of input validation or escaping is present in the skill instructions before the data is passed to the shell and the external API.

fittings-semver-range-resolve