fittings-nhc-active-cyclones

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The URL https://fittings.sh/skill/call.mjs is a direct download of a JavaScript module the user is explicitly instructed to run (node call.mjs), which can execute arbitrary code and exfiltrate secrets (high risk); the other URLs are API/catalog endpoints and are lower risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documents a paid API flow that requires a wallet/private key (FITTINGS_PRIVATE_KEY), uses USDC on Base, and instructs running a client (node call.mjs) that signs an authorization to pay a quoted price. It also references EVM tooling (@x402/evm). These are concrete crypto payment instructions and signing steps (wallet integration / transaction authorization), i.e. explicit financial execution capability.