fittings-doc-url-metadata

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The document instructs downloading and executing a remote JavaScript module (https://fittings.sh/skill/call.mjs) with curl + node, which is equivalent to running an untrusted script and is a high-risk distribution pattern for malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow explicitly performs a live fetch of a caller-supplied public URL and ingests the page’s meta tags (title/description/preview) from that outsider-controlled content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's documentation shows fetching and then executing remote code (curl -sO https://fittings.sh/skill/call.mjs followed by node call.mjs), meaning the URL https://fittings.sh/skill/call.mjs provides code that would be run at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates crypto payment signing: it describes paying a signed quote using a wallet holding USDC on Base, instructs setting FITTINGS_PRIVATE_KEY (private key) to authorize payment, and references EVM libraries (@x402/evm). Those are specific blockchain/wallet signing capabilities (crypto payments), so this grants direct financial execution authority.