fittings-kev-status

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The URL https://fittings.sh/skill/call.mjs is a direct download of an executable JavaScript module which the doc explicitly instructs users to run (including setting a private key), creating a high risk of secret-exfiltration or malicious actions if the script is untrusted.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs fetching and executing remote code via "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", so the URL https://fittings.sh/skill/call.mjs is used at runtime to retrieve and execute remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a paid API flow that requires a crypto wallet and signing an authorization: it describes a 402 payment flow with a signed quote and facilitator settlement, shows commands that require setting FITTINGS_PRIVATE_KEY and a wallet holding USDC on Base, and references EVM tooling (@x402/evm). These are specific crypto/payment instructions (wallet private key, on-chain token/currency) enabling transaction signing and payment, which count as direct financial execution capability.