fittings-nasa-power-point

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The URL https://fittings.sh/skill/call.mjs is a direct downloadable JavaScript module with explicit instructions in the document to curl and execute it (node call.mjs), which is equivalent to running an untrusted executable and is a high-risk distribution vector for malware.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a paid calling flow that requires a crypto wallet/private key and signs an authorization to settle payment. It instructs exporting FITTINGS_PRIVATE_KEY, specifies a wallet holding USDC on Base, describes signing an authorization and facilitator settlement, and references EVM-related libraries (@x402/evm). These are specific crypto/wallet payment instructions (direct financial execution), not generic API callers or browser automation.