fittings-kev-recent

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include an instruction to download and execute a JavaScript module (call.mjs) from an unverified domain and to supply a private key, which is a high-risk pattern for malware or credential theft.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs downloading and executing remote JavaScript (curl -sO https://fittings.sh/skill/call.mjs then node call.mjs), which fetches and runs remote code at runtime (https://fittings.sh/skill/call.mjs).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid API flow that requires signing an authorization with a crypto wallet and spending USDC on Base. It references a client (call.mjs) that is run with FITTINGS_PRIVATE_KEY, shows the "402 Payment Required" signed-quote flow, and points to EVM-related libraries (@x402/evm). Those details indicate direct financial execution capability (wallet signing and settling payments), not merely a generic HTTP or browser tool.