fittings-govinfo-public-law

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include a direct download of an executable JavaScript module (call.mjs) from an external domain and instructions to run it while supplying a plaintext private key, which is a high-risk vector for malware distribution and credential theft.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime workflow described by the skill calls the GovInfo API (api.govinfo.gov) via GET https://fittings.sh/v1/govinfo/public-law and can optionally ingest enacted law text supplied/selected by user-provided congress/law parameters, which are outside-authored identifiers for the law content.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid gateway that requires cryptographic signing from a wallet: it shows exporting FITTINGS_PRIVATE_KEY and running node call.mjs to pay, references holding USDC on Base, warns about plaintext keys, and cites @x402/evm/@x402/core for signing. Those are specific crypto wallet/signing payment mechanisms (Direct Financial Execution capability), not merely generic HTTP or browser automation.