The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires a blockchain private key (FITTINGS_PRIVATE_KEY) to be provided as an environment variable to authorize payments via the x402 protocol. While this is the intended mechanism for the service, handling private keys in plaintext environment variables presents a risk of exposure.
[EXTERNAL_DOWNLOADS]: The documentation in SKILL.md recommends downloading a script (call.mjs) from the vendor's domain https://fittings.sh to interact with the service.
[REMOTE_CODE_EXECUTION]: The skill requires downloading a remote script and executing it locally using Node.js to perform search queries and handle payments.
[COMMAND_EXECUTION]: The instructions guide the user to execute shell commands for downloading the client and running the Node.js script.
[PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes and displays structured data from an external API.
Ingestion points: Product classification data returned from https://fittings.sh/v1/hts/search (referenced in SKILL.md).
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in SKILL.md or the call.mjs script.
Capability inventory: The call.mjs script performs network requests and cryptographic signing of messages using the provided private key.
Sanitization: The script parses JSON responses but does not include explicit sanitization or filtering of the text content before it is processed.

hts-search