The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill relies on the FITTINGS_PRIVATE_KEY environment variable to sign blockchain transactions. The documentation acknowledges that the key is stored in plaintext in the execution environment and recommends using a dedicated throwaway wallet to minimize risk.\n- [EXTERNAL_DOWNLOADS]: The skill documentation provides instructions to download the call.mjs execution script from the vendor's domain at https://fittings.sh/skill/call.mjs.\n- [COMMAND_EXECUTION]: The skill requires the execution of the call.mjs Node.js script, which accesses environment variables and performs network operations to interact with the vendor's payment gateway and API.\n- [REMOTE_CODE_EXECUTION]: The instruction to download and execute call.mjs from the vendor's infrastructure constitutes a remote code execution vector common in decentralized application skills.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the processing of external data (Category 8).\n
Ingestion points: Federal spending data is fetched from the https://fittings.sh/v1/gov/federal-spending endpoint.\n
Boundary markers: The script and documentation do not provide explicit delimiters or instructions to the agent to disregard instructions embedded in the API response.\n
Capability inventory: The script has network access, environment variable access, and filesystem read capabilities (used for self-verification).\n
Sanitization: There is no evidence of sanitization or validation of the retrieved JSON content before it is passed to the agent's context.

gov-federal-spending