fittings-calc-worksheet

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Suspicious: the document instructs downloading and executing a remote JavaScript module (call.mjs) from an unverified domain and to supply a private key, which is a common vector for malware or credential theft.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs fetching and then executing remote JavaScript (curl -sO https://fittings.sh/skill/call.mjs followed by node call.mjs), which is a runtime download-and-run of external code (https://fittings.sh/skill/call.mjs).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates a crypto payment flow: it returns a signed quote (402), requires the caller to "sign an authorization", and shows commands to set a private key (FITTINGS_PRIVATE_KEY) and run a client that will pay using a wallet holding USDC on Base. It therefore includes wallet-based signing/authorization for payment (crypto/blockchain), which is a direct financial execution capability.