fittings-geo-distance

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs point to a small, non-obvious domain that instructs users to download and execute a remote JavaScript module (call.mjs), which is a high-risk pattern because running fetched code from an untrusted host can deliver malware or steal keys.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill's docs include an explicit payment flow that requires signing authorizations with a crypto wallet/private key (exporting FITTINGS_PRIVATE_KEY), references holding USDC on Base, and mentions EVM-related client libraries (@x402/evm). That is a specific crypto payment integration and enables the agent to sign/pay for calls, so it grants direct financial execution capability.