fittings-fx-convert

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The document instructs downloading and running a JavaScript module (call.mjs) from fittings.sh and even suggests placing a private key in plaintext for use with it, which is a high-risk pattern for distributing malicious scripts or exfiltrating credentials.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's example instructs fetching and executing remote code via "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", which is a runtime fetch of remote code that is then executed locally (https://fittings.sh/skill/call.mjs).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid call flow that requires a crypto wallet/private key to sign an authorization and pay in USDC on Base (402 Payment Required, signed quote, FITTINGS_PRIVATE_KEY, recommendation to use a wallet, FITTINGS_MAX_PRICE, references to @x402/evm). That is an explicit crypto payment signing and settlement capability (direct financial execution).