The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation recommends downloading a support script (call.mjs) directly from the vendor's domain at https://fittings.sh/skill/call.mjs if it is not present in the local environment.
[COMMAND_EXECUTION]: The SKILL.md file provides shell instructions to the agent for executing Node.js scripts and configuring environment variables to facilitate API calls and payment processing.
[CREDENTIALS_UNSAFE]: To use the metered API, the skill requires a blockchain private key (FITTINGS_PRIVATE_KEY). The documentation suggests exporting this key as an environment variable, which is a sensitive practice for managing cryptographic credentials.
[REMOTE_CODE_EXECUTION]: The included call.mjs script contains logic to verify its own integrity by comparing its local SHA256 hash against a remote value at https://fittings.sh/skill/call.mjs.sha256. If the hashes do not match, the script prompts the user to download a new version, creating a mechanism for remote code updates.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text input sent to an external language detection service. The results returned are processed by the agent, presenting a surface for indirect prompt injection. 1. Ingestion points: Untrusted text input and JSON response from fittings.sh in call.mjs. 2. Boundary markers: None; output is printed directly. 3. Capability inventory: Network access and shell command execution. 4. Sanitization: None observed for the API response.

lang-detect