fittings-crossref-doi-metadata

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include an instruction to download and execute a remote JavaScript module (https://fittings.sh/skill/call.mjs), which is remote code execution risk and matches "run before using" / untrusted-executable indicators.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill embeds an explicit crypto payment flow: the endpoint may return a "402 Payment Required" with a signed quote that the client must sign and authorize, and the example shows using a wallet (USDC on Base) by setting FITTINGS_PRIVATE_KEY to sign payments. It references EVM helper libraries (@x402/evm) and warns about private key handling. These are concrete instructions and parameters to authorize on-chain/custodied payments, so the skill grants direct financial execution capability.