fittings-cve-lookup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). One URL (https://fittings.sh/skill/call.mjs) is a direct download of a JavaScript executable the docs instruct users to fetch and run, which can execute arbitrary code from an external/unverified source and is therefore potentially dangerous.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid API flow that requires a crypto wallet and signing authorizations: it instructs setting FITTINGS_PRIVATE_KEY, describes a wallet holding USDC on Base, says "you sign an authorization" and mentions EVM-related client libraries (@x402/evm). Those are concrete crypto payment primitives (signing and authorizing transfers/settlements) and therefore grant direct financial execution capability.