fittings-nhtsa-safety-ratings

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly instructs setting a private key on the command line (export FITTINGS_PRIVATE_KEY=0x...) and describes the key sitting in plaintext, which encourages embedding a secret value verbatim in shell commands or agent output — an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The document instructs downloading and running a JavaScript executable (call.mjs) from an unvetted domain and to provide a private key, which is a high-risk pattern for malware or credential theft.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit crypto payment flow: the endpoint can return a signed quote and the provided client (call.mjs) can sign an authorization using a private key (FITTINGS_PRIVATE_KEY) and cause settlement in USDC on Base. The doc instructs exporting a private key, running the client to pay, and notes the facilitator broadcasts/pays gas. Those are concrete wallet/signing/payment instructions (crypto/blockchain transaction execution), so the skill grants direct financial execution capability.