fittings-fec-financial-totals

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The direct download link to an executable script (https://fittings.sh/skill/call.mjs) and explicit instructions to run it (node call.mjs) from a non-official, single-domain host are high-risk indicators for distributing malware; the other URLs are API/catalog endpoints and are not flagged.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and executing remote code ("curl -sO https://fittings.sh/skill/call.mjs" then "node call.mjs"), so https://fittings.sh/skill/call.mjs is a runtime external dependency that would execute remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes crypto payment integration: the docs describe a paywall flow that returns a signed quote (402), requires the caller to "sign an authorization", and instructs using a wallet holding USDC on Base with an environment variable FITTINGS_PRIVATE_KEY (export FITTINGS_PRIVATE_KEY=0x...). It references EVM helper libraries (@x402/evm) and warns the private key sits in plaintext where the agent runs. These are specific, concrete crypto payment/signing instructions (wallet/private-key usage and signing), which constitute direct financial execution capability.