fittings-nasa-astronomy-picture

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These instructions tell the user to curl and run a remote .mjs script (https://fittings.sh/skill/call.mjs), which is effectively downloading and executing code from a third-party domain — a common malware distribution pattern and therefore suspicious.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs fetching and executing remote code at runtime via "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", so the fetched script (https://fittings.sh/skill/call.mjs) would execute as a required runtime dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit on-chain payment flow: metered pricing, the endpoint returns a 402 with a signed quote that "you sign an authorization", instructions to supply a private key (export FITTINGS_PRIVATE_KEY=0x...), and mentions using USDC on Base and @x402/evm. Those are specific crypto/blockchain signing and wallet operations (wallet private key, signing authorization, facilitator broadcasting gas), which constitute direct financial execution capability.