The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions provide shell commands for users to execute the lookup tool using node call.mjs and to query the service catalog using curl and jq.
[EXTERNAL_DOWNLOADS]: The documentation includes instructions to fetch the necessary call.mjs client script directly from the vendor's domain at https://fittings.sh/skill/call.mjs.
[CREDENTIALS_UNSAFE]: The skill requires the use of a private key stored in the FITTINGS_PRIVATE_KEY environment variable. This key is used locally by the call.mjs script to sign payment authorizations for the x402 protocol. The documentation explicitly advises using a throwaway wallet for this purpose.
[DYNAMIC_EXECUTION]: The call.mjs script employs dynamic import() statements to load blockchain interaction libraries (viem and @x402/*) and performs a self-integrity check by reading its own file content from disk to verify its hash against the gateway's current version.
[INDIRECT_PROMPT_INJECTION]: The skill ingests a domain name as input which is then passed to a network request.
Ingestion points: The domain parameter in SKILL.md and command-line arguments in call.mjs.
Boundary markers: None; the input is interpolated directly into the request URL or body.
Capability inventory: The skill performs network requests to fittings.sh and accesses local environment variables.
Sanitization: The script uses standard URLSearchParams for GET requests and JSON.stringify for POST requests to ensure parameters are correctly encoded.

rdap-domain