fittings-fec-candidate-search

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The bundle includes a direct download link to an executable JavaScript module (call.mjs) that the document instructs you to run locally, which is a high-risk distribution vector from a non-official source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs downloading and executing remote code via "curl -sO https://fittings.sh/skill/call.mjs" and then running it with "node call.mjs", so https://fittings.sh/skill/call.mjs is a runtime external dependency that executes remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid API flow that requires signing an authorization with a crypto wallet private key (FITTINGS_PRIVATE_KEY), mentions holding USDC on Base, signing and settling quotes, and references EVM helper libraries (@x402/evm). Those are specific crypto payment/wallet integration details enabling the agent to authorize and spend funds (direct financial execution).