fittings-cfr-section-text

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The listing provides a direct download of a script (https://fittings.sh/skill/call.mjs) and explicitly instructs users to curl and run it and to set a private key environment variable, which is a high-risk pattern for distributing malware or credential-stealing code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a payment flow that requires a wallet/private key and signing authorizations: it returns a 402 with a signed quote, instructs setting FITTINGS_PRIVATE_KEY and running node call.mjs, references USDC on Base, and mentions EVM-related packages (@x402/evm). These are specific crypto payment/signing capabilities (wallet signing and token payment), not merely a generic API caller or browser automation, so it grants direct financial execution authority.