fittings-fmt-xml-to-json

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The URL https://fittings.sh/skill/call.mjs is a direct link to executable JavaScript hosted on an unrecognized domain (suitable for remote code execution if fetched and run), making it potentially risky; the other URLs are API/catalog endpoints and are lower risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid API flow that requires signing payment authorizations and using a wallet/private key (FITTINGS_PRIVATE_KEY), references USDC on Base, and points to crypto-specific client libraries (@x402/evm). Those details show the skill enables authorizing and settling crypto payments for calls (i.e., direct financial execution capability), not merely a generic API caller.