The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires a blockchain private key to be stored in the FITTINGS_PRIVATE_KEY environment variable for metered payments. While the documentation explicitly warns users to use a throwaway wallet, this method of credential handling exposes sensitive keys to the local environment and any process that can read it.
[COMMAND_EXECUTION]: The instructions include shell commands for executing the provided call.mjs script using node and suggest using curl to fetch the script directly from the vendor's website if it is missing.
[REMOTE_CODE_EXECUTION]: The call.mjs script employs dynamic import() statements to load the @x402/fetch, @x402/evm, and viem libraries. While these are legitimate dependencies for the skill's payment functionality, dynamic loading can be a vector for code injection if local files are compromised.
[EXTERNAL_DOWNLOADS]: The skill documentation suggests downloading the client script from https://fittings.sh/skill/call.mjs as a fallback or update mechanism.
[DATA_EXFILTRATION]: The script communicates with https://fittings.sh to fetch service metadata, request payment quotes, and perform a self-integrity check by sending a SHA-256 hash of its own source code to the vendor's server.

dailymed-spl-search