fittings-ndc-package-lookup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs setting a private key in the FITTINGS_PRIVATE_KEY environment variable (export FITTINGS_PRIVATE_KEY=0x...) and notes the key "sits in plaintext", which would require an agent to handle or embed the secret value verbatim when constructing commands or runs.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include a direct download (https://fittings.sh/skill/call.mjs) that the skill tells users to curl and run with node — effectively executing untrusted remote code (and it handles wallet private keys), which is a high-risk distribution pattern.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Required runtime workflow reads outsider-provided NDC input from the caller (the ndc field in the GET request to https://fittings.sh/v1/ndc/package-lookup) and then retrieves a directory record, so the agent ingests free text from outside without selecting a specific pre-defined item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL instructs downloading and executing remote code at runtime via "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", which fetches and runs external JavaScript from fittings.sh.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly requires signing a payment authorization with a crypto wallet: it describes a 402 "Payment Required" flow with a signed quote, instructs exporting FITTINGS_PRIVATE_KEY and using a wallet holding USDC on Base to pay, and discusses signing/settling (facilitator broadcasts gas). This is direct crypto payment execution (wallet signing), not just a generic API caller, so it grants direct financial execution capability.