The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md documentation provides example curl and node commands to demonstrate how to interact with the service and use the included call.mjs script.
[DATA_EXPOSURE]: The skill requires a private key (FITTINGS_PRIVATE_KEY) for paid requests. The documentation correctly advises using a throwaway wallet with minimal funds and storing the key in environment variables rather than hardcoding it, which aligns with security best practices for agentic environments.
[EXTERNAL_DOWNLOADS]: The documentation mentions fetching an updated version of the call.mjs script from https://fittings.sh if it is missing. This is a reference to the vendor's own infrastructure and is used for maintenance.
[REMOTE_CODE_EXECUTION]: The call.mjs script performs a self-integrity check by hashing its own content and comparing it against a hash served by https://fittings.sh/skill/call.mjs.sha256. This is a security feature intended to prevent users from signing payments with outdated or potentially compromised logic.
[COMMAND_EXECUTION]: The script uses node:crypto and node:fs to perform the integrity check. This is restricted to reading its own file path via import.meta.url and does not represent arbitrary file system access.

pubmed-search