fittings-fx-ecb-timeseries

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The skill instructs downloading and executing a JavaScript module (call.mjs) directly from an external domain and to run it with node (including handling a private key), which is a high-risk pattern for distributing malicious code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's README instructs fetching and executing remote code ("curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs"), so https://fittings.sh/skill/call.mjs is a runtime-fetched script that would be executed locally.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is primarily a data API but explicitly includes an integrated payment flow that requires signing authorizations with an on-chain wallet. The docs describe the endpoint returning a 402 quote, the client signing an authorization, and instruct setting FITTINGS_PRIVATE_KEY (exporting a private key) to pay with USDC on Base. That enables an agent with the key to authorize real crypto payments, so it grants direct financial execution capability.