fittings-pubmed-citation-search

The skill’s core purpose is coherent, but its execution model is not proportionate: it downloads and runs remote JS from fittings.sh and, for paid use, forwards a wallet private key to that client for signing/payment. Because a simple PubMed search should not require executing remotely fetched code with access to financial credentials, this is suspicious with high supply-chain and credential-forwarding risk, though not confirmed malware.