fittings-lei-lookup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The instructions tell the user to curl and run an external JavaScript file (https://fittings.sh/skill/call.mjs) and to place a private key in plaintext, which is high-risk because running untrusted remote code can exfiltrate credentials or perform malicious actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes an explicit runtime download and execution of remote code via "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", so the URL https://fittings.sh/skill/call.mjs supplies code that is fetched and executed at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit crypto payment flow: it lists a price, describes a 402 signed-quote flow that you must sign to authorize payment, and shows example usage requiring a private key (FITTINGS_PRIVATE_KEY) and a wallet holding USDC on Base. It also references EVM tooling (@x402/evm). These are concrete blockchain/wallet signing instructions (direct crypto financial execution), not merely generic HTTP or browsing capabilities.