fittings-ctgov-eligibility-screen

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The skill instructs downloading and running an external JavaScript executable (https://fittings.sh/skill/call.mjs), which is a high-risk pattern because running a remote script from an untrusted/unknown host can execute arbitrary/malicious code or expose secret keys.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs fetching and executing remote code (curl -sO https://fittings.sh/skill/call.mjs followed by node call.mjs), so https://fittings.sh/skill/call.mjs is a runtime external dependency that runs remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is not just a generic API caller: it explicitly describes a metered payment flow that requires signing with a crypto wallet (export FITTINGS_PRIVATE_KEY=0x...), uses USDC on Base, mentions signing an authorization and facilitator settlement, and references EVM-related client libraries (@x402/evm). Those are concrete crypto/payment instructions and wallet usage that enable the agent to initiate real payments, so this grants direct financial execution capability.