fittings-hts-lookup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs point to a service that instructs users to download and execute a remote JavaScript module (call.mjs) with Node.js — a high-risk pattern because running an untrusted remote script can execute arbitrary code and exfiltrate secrets (e.g., wallet private keys).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs fetching and then executing remote code via "curl -sO https://fittings.sh/skill/call.mjs" and "node call.mjs", so the URL https://fittings.sh/skill/call.mjs is a runtime external dependency that downloads code which is executed locally.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill describes an explicit payment flow using cryptocurrency wallets: the endpoint returns a 402 with a signed quote that the caller must sign, and the example shows exporting FITTINGS_PRIVATE_KEY and running call.mjs to pay (USDC on Base). It instructs using a wallet/private key and npm evm libraries for signing — i.e., a concrete crypto payment signing and settlement integration (direct financial execution).