The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The call.mjs script utilizes the FITTINGS_PRIVATE_KEY environment variable to sign payment authorizations for the service. The documentation provides clear transparency regarding the risks of plaintext keys in the execution environment and advises the use of throwaway wallets for this purpose.- [EXTERNAL_DOWNLOADS]: The skill requires several external Node.js dependencies including @x402/fetch, @x402/evm, and viem. It also provides a method to download and update the client script directly from the vendor's domain.- [COMMAND_EXECUTION]: The skill involves executing the call.mjs script using the node runtime to process API calls and handle the payment handshake.- [PROMPT_INJECTION]: The skill processes untrusted metadata retrieved from external URLs, which creates a surface for indirect prompt injection.
Ingestion points: Data enters via the call.mjs script's retrieval of metadata from the fittings.sh API, which contains content from user-supplied URLs.
Boundary markers: The instructions do not define specific delimiters or warnings for the agent to distinguish between tool output and potential instructions embedded within the metadata strings.
Capability inventory: The script has the capability to perform network operations and read its own source code from the filesystem.
Sanitization: The API response is parsed as JSON, but the individual string fields (title, description) are not filtered for potentially malicious instructions.

doc-url-metadata