fittings-energy-uk-carbon-intensity

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Contains a direct download of an executable script (call.mjs) with explicit instructions to run it (node call.mjs), which is a high-risk pattern for distributing malware unless the source is fully trusted and verified.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill documentation explicitly instructs downloading and executing remote code (curl -sO https://fittings.sh/skill/call.mjs and then node call.mjs), so https://fittings.sh/skill/call.mjs is a runtime external dependency that fetches code executed locally.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit payment flow using crypto wallets: the endpoint returns a "402 Payment Required" with a signed quote that "you sign an authorization", example client shows exporting FITTINGS_PRIVATE_KEY (0x...) and running call.mjs, and the doc instructs using a wallet holding USDC on Base. It also references EVM tooling (@x402/evm). These are specific crypto/payment mechanisms (wallet private key signing and facilitator-settled payments), i.e., direct financial execution capability.