fittings-geo-elevation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The skill instructs users to curl and run a remote JavaScript module (https://fittings.sh/skill/call.mjs) from an unverified domain — downloading and executing code from an external host is a risky distribution pattern that can be used to deliver malware.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes an on-chain/crypto payment flow: the endpoint returns a 402 with a signed quote that the client must sign off-chain, and the example shows setting FITTINGS_PRIVATE_KEY and using a wallet holding USDC on Base to pay. It references EVM-related client packages (@x402/evm) and details signing, a payer key, and spending limits (FITTINGS_MAX_PRICE). These are specific crypto/wallet payment instructions (signing authorizations and using a private key), which constitute direct financial execution capability.