The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation instructs the user to download the call.mjs script from the vendor's domain (fittings.sh) using curl if it is not already present.\n- [COMMAND_EXECUTION]: The skill relies on the execution of shell commands and a Node.js script (call.mjs) to perform API calls and handle payment protocols.\n- [CREDENTIALS_UNSAFE]: The skill requires a private key via the FITTINGS_PRIVATE_KEY environment variable. The documentation acknowledges that this key is stored in plaintext where the agent runs.\n- [PROMPT_INJECTION]: The skill has an indirect injection surface through the ingestion of user-provided state and incident type strings.\n
Ingestion points: Parameters like state and incidentType passed as arguments to call.mjs.\n
Boundary markers: None identified; input is interpolated into URL search parameters.\n
Capability inventory: Network access (fetch) and cryptographic signing capabilities for transaction authorization.\n
Sanitization: The script performs basic type validation for numerical and boolean inputs, while strings are processed through standard URL encoding.

fema-disaster-declarations