The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes network requests to fittings.sh for its core functionality and to fetch an integrity hash for its local script from https://fittings.sh/skill/call.mjs.sha256. These requests target the vendor's infrastructure for legitimate tool operations.\n- [COMMAND_EXECUTION]: The skill utilizes a local Node.js script (scripts/call.mjs) to perform API calls. The documentation also provides instructions for users to manually update the script using curl from the vendor's website.\n- [DATA_EXFILTRATION]: User-supplied data, such as IBANs and text strings, are transmitted to the remote API at fittings.sh. While this is the intended behavior for validation and hashing, it involves sending potentially sensitive identifiers to an external service.\n- [PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection. It ingests untrusted data from various sources (spreadsheets, user input, etc.) and processes it without explicit boundary markers or advanced sanitization, which could lead the agent to misinterpret malicious instructions embedded in the data.\n
Ingestion points: Data enters via the parseArgs function in scripts/call.mjs and the text parameter for hashing services.\n
Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions for the processed data.\n
Capability inventory: The skill has the capability to make network requests, read the local file system (integrity check), and sign blockchain transactions using a private key.\n
Sanitization: Input is coerced into types (number, boolean, etc.) but the content of strings is not sanitized for potential prompt injection attacks.

identifier-check