fittings-fmt-json-flatten

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs point to a small API/service on fittings.sh where one link (https://fittings.sh/skill/call.mjs) is a direct script the docs suggest fetching/running to perform a payment handshake, which is a high-risk pattern (downloading/executing code from an untrusted/unknown source).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill describes a payment flow that requires signing an authorization (402 Payment Required), using a PAYMENT-SIGNATURE header, and explicitly references holding a wallet/private key and USDC on Base. It also mentions client libraries (@x402/core, @x402/evm) and the need to re-sign requests. These are explicit crypto payment/signing integrations (wallet signing and on-chain facilitator settlement), which enable direct financial execution for paying the service.