The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation instructs users to download a JavaScript client (call.mjs) from a remote server (https://fittings.sh/skill/call.mjs) using curl and execute it locally using node.
[CREDENTIALS_UNSAFE]: The skill utilizes a blockchain private key for payment signing. The instructions direct the user to store this sensitive credential in the FITTINGS_PRIVATE_KEY environment variable, where it is accessed in plaintext by the call.mjs script.
[COMMAND_EXECUTION]: The call.mjs script uses the node:fs and node:crypto modules to read its own source code from the file system and generate a SHA-256 hash for integrity verification against a remote endpoint.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs several external dependencies at runtime, including @x402/fetch, @x402/evm, and viem to facilitate cryptocurrency transactions.
[INDIRECT_PROMPT_INJECTION]: The skill processes live weather alert data from the National Weather Service API through a third-party gateway (fittings.sh). The ingested data is interpolated into the agent's context, creating a surface for potential injection if the remote data is malformed or malicious.

nws-active-alerts