pubmed-citation-search
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a Node.js script (
call.mjs) designed to be executed by the user to interact with the PubMed API and handle the x402 payment protocol. - [EXTERNAL_DOWNLOADS]: The documentation provides instructions to download the helper script directly from the vendor's domain at
fittings.sh. The script also performs an integrity check by fetching a version hash from the same vendor domain to ensure the local script is current. - [CREDENTIALS_UNSAFE]: The skill facilitates API payments using a private key provided through the
FITTINGS_PRIVATE_KEYenvironment variable. The documentation provides a security warning advising users to use a dedicated throwaway wallet for this purpose to minimize risk. - [PROMPT_INJECTION]: As the skill retrieves and processes external research data from PubMed, it possesses an attack surface for indirect prompt injection common to data-retrieval tools.
Audit Metadata