Install
$ agentstack add skill-chronoaiproject-ornn-api-fetch-wrapper Open-source listing, not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged1 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Reads credentials/environment and may exfiltrate them.
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
api-fetch-wrapper
The case that breaks first in production — a skill that hits an external service. This example covers the four things every such skill needs: secret handling, retry policy, error normalisation, and no-leak-on-failure logging.
Contract
Input (stdin, JSON):
{ "latitude": 52.52, "longitude": 13.41 }
Output (stdout, JSON):
{
"temperatureC": 18.4,
"windSpeedKmh": 12.6,
"fetchedAt": "2026-05-19T08:00:00.000Z"
}
Errors — written to stderr as {"error": "...", "cause": "..."} and exit code 1. Error messages NEVER include the raw upstream response body (it might echo a secret); they include the upstream status code and a short canonical reason.
Required environment
| Var | Purpose | |---|---| | OPEN_METEO_URL | Optional override of the upstream host. Defaults to https://api.open-meteo.com. | | (none for auth) | Open-Meteo is keyless. For an auth'd API, the same skeleton reads process.env.YOUR_API_KEY and passes it via Authorization header. |
Run locally
cd examples/api-fetch-wrapper
bun install
echo '{"latitude":52.52,"longitude":13.41}' | bun run src/index.ts
Adapt this
- Different API — replace the URL, query params, and response shape. The retry / error-mapping skeleton stays.
- API-key auth — read
process.env.YOUR_API_KEYonce at the top, pass it viaAuthorization: Bearer ${apiKey}, and ensure the key never appears in error messages. - Stronger retry — bump
MAX_ATTEMPTS, add exponential backoff with jitter, or distinguish 5xx (retry) vs 4xx (do not retry) explicitly. - Cache — wrap the fetch in a TTL cache when the upstream rate-limits.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: ChronoAIProject
- Source: ChronoAIProject/Ornn
- License: Apache-2.0
- Homepage: https://ornn.chrono-ai.fun
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.