fittings-ghsa-advisory

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The skill instructs downloading and running a remote script (call.mjs) from fittings.sh, which is an unverified direct executable and a high-risk pattern for malware distribution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's example downloads and then runs remote JavaScript with "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", meaning the fetched URL (https://fittings.sh/skill/call.mjs) provides executable code at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a paid API flow that requires signing an on-chain/off-chain authorization with a crypto wallet: it returns a signed quote (402), the client must set FITTINGS_PRIVATE_KEY and hold USDC on Base to pay, the client signs an authorization and a facilitator settles the transaction, and the docs reference EVM libraries (@x402/evm). This is a specific crypto payment mechanism (wallet signing/spending), i.e. direct financial execution authority.