The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the execution script call.mjs and an integrity hash from the vendor's domain at fittings.sh to facilitate API interactions.
[COMMAND_EXECUTION]: The documentation provides instructions to download and execute the call.mjs Node.js script to interact with the paid metadata service.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied DOI strings which are interpolated into requests to the Crossref metadata endpoint, representing a potential injection surface.
Ingestion points: The doi argument defined in SKILL.md and passed to call.mjs.
Boundary markers: None identified in the prompt instructions or script logic.
Capability inventory: The skill performs network requests via fetch and signs blockchain payment authorizations.
Sanitization: DOI inputs are URL-encoded but otherwise lack strict validation or escaping.
[CREDENTIALS_UNSAFE]: The skill relies on the FITTINGS_PRIVATE_KEY environment variable to sign payment authorizations. While the author provides explicit warnings about plaintext storage and recommends throwaway wallets, this pattern involves handling sensitive credentials in the execution environment.

crossref-doi-metadata