fittings-bls-series

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). One of the URLs is a direct download of a Node script (call.mjs) from an unverified personal domain with instructions to curl and execute it, which is a common malware distribution pattern.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs downloading and then executing remote code via "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", so https://fittings.sh/skill/call.mjs is a runtime-fetched script that is executed locally.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes an on-chain payment flow: the endpoint returns a signed quote, the client must sign an authorization, and a facilitator settles it. The docs show command-line usage that requires setting FITTINGS_PRIVATE_KEY and a wallet holding USDC on Base, and reference EVM libraries (@x402/evm). These are specific crypto wallet/signing instructions that enable programmatic spending, which is direct financial execution capability.