The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface. It is designed to ingest data from arbitrary external URLs, including raw HTML, metadata, and DNS records, and convert it into Markdown for processing by the agent.
Ingestion points: Data enters through tools like doc.url-to-markdown, doc.url-metadata, and url.expand (SKILL.md).
Boundary markers: The provided recipes do not include mandatory boundary markers or instructions to ignore embedded commands in the fetched content.
Capability inventory: The skill uses scripts/call.mjs for network operations and allows the agent to execute shell commands to call these services.
Sanitization: While HTML is converted to Markdown, this process does not sanitize natural language instructions that might be embedded in the source page to influence the agent's behavior.
[REMOTE_CODE_EXECUTION]: The script scripts/call.mjs includes a self-integrity check that compares its local hash against a remote hash provided by the vendor's gateway. If the script is out of date, it suggests that the user manually update it using curl -sO https://fittings.sh/skill/call.mjs, which involves downloading and overwriting local executable code from a remote source.
[CREDENTIALS_UNSAFE]: The skill requires the use of FITTINGS_PRIVATE_KEY, a sensitive blockchain private key used to sign USDC transactions for pay-per-call services. While the documentation follows safe practices by instructing users to use environment variables rather than hardcoding, the presence and handling of a raw private key in the environment represents a high-value target for potential exfiltration scripts if the agent's environment is compromised.

web-lookup