fittings-calc-evaluate

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs include a direct download of an executable Node script (https://fittings.sh/skill/call.mjs) hosted on an unverified domain and the documentation explicitly instructs users to curl and run it, which is a high-risk pattern for malware distribution.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation includes an explicit crypto payment flow: it requires/accepts a private key (FITTINGS_PRIVATE_KEY), references a wallet holding USDC on Base, describes signing an authorization for a quoted payment, and points to EVM libraries (@x402/evm) and a client (call.mjs) that will perform settlement. These are specific, concrete crypto/payment integration details (signing and settling payments), so the skill grants direct financial execution capability.