The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the setup of a FITTINGS_PRIVATE_KEY environment variable to facilitate off-chain payment signing for metered API calls. It explicitly acknowledges that the key remains in plaintext within the execution environment and advises the use of a throwaway wallet to limit potential exposure.- [EXTERNAL_DOWNLOADS]: The skill identifies external dependencies including the NPM packages @x402/core and @x402/evm for handling the 402 payment protocol. It also references a remote script https://fittings.sh/skill/call.mjs provided by the vendor to manage the payment handshake.- [REMOTE_CODE_EXECUTION]: The skill suggests executing the vendor-hosted script https://fittings.sh/skill/call.mjs to automate the payment authorization and retry process. While this is a vendor-provided resource, it creates a runtime dependency on externally hosted code.- [COMMAND_EXECUTION]: The skill provides curl command examples to perform catalog lookups and execute the spatial compute task against the fittings.sh API.- [INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill processes potentially large and complex GeoJSON polygon and point data objects provided as input to the computation endpoint.
Boundary markers: There are no explicit boundary markers or instructions provided to the agent to ignore or sanitize content embedded within the GeoJSON data structures.
Capability inventory: The skill utilizes curl for network requests to send user-provided data to the remote API.
Sanitization: No internal validation or sanitization steps are defined for the input geometry data before it is processed or transmitted.

fittings-spatial-point-in-polygon