The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download a remote script using curl -sO https://fittings.sh/skill/call.mjs and subsequently execute it using node call.mjs. This pattern allows for the execution of arbitrary code fetched from a remote server at runtime.
[CREDENTIALS_UNSAFE]: The instructions direct the user to export a sensitive blockchain private key into the environment using export FITTINGS_PRIVATE_KEY=0x.... The skill documentation acknowledges that this key will reside in plaintext within the execution environment, which poses a risk of credential exposure to the agent or other processes.
[EXTERNAL_DOWNLOADS]: The skill fetches external resources from fittings.sh, including the execution client call.mjs and the service catalog. While these originate from the vendor's domain, they represent external dependencies required for the skill to function.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied station and date inputs which are passed to the remote endpoint. It lacks explicit instructions for sanitizing or delimiting these inputs before they are incorporated into the execution command, creating a surface for potential injection if the inputs are not properly handled by the downloaded script.

fittings-water-noaa-tides