The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download an external script (call.mjs) from https://fittings.sh/skill/call.mjs and execute it using the node runtime. This allows for the execution of arbitrary remote code that is not part of the skill's static distribution.
[CREDENTIALS_UNSAFE]: The execution model requires a sensitive blockchain private key (FITTINGS_PRIVATE_KEY) to be set as an environment variable. The documentation acknowledges that this key is stored in plaintext within the agent's execution environment, which is a significant security risk if the environment is compromised.
[COMMAND_EXECUTION]: The skill relies on shell commands (curl, node) for its primary functionality. These commands interpolate user-provided inputs (such as drug names or NDCs) as arguments, which can present a surface for command injection if the agent does not properly sanitize the input strings before execution.
[EXTERNAL_DOWNLOADS]: The skill downloads resources from fittings.sh. Although these are vendor-provided tools, the mechanism of fetching and running a script at runtime creates a dependency on the security and availability of the remote host.

fittings-dailymed-spl-search