fittings-nws-point-forecast

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include an instruction to download and execute a JavaScript module (call.mjs) from an untrusted domain, which is a high-risk pattern for distributing malware or arbitrary remote code execution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs fetching and executing remote code with "curl -sO https://fittings.sh/skill/call.mjs" followed by running "node call.mjs", so the content at that URL would be fetched and executed at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a metered paid endpoint that issues a signed quote and requires the caller to "sign an authorization" to settle. It instructs using a wallet holding USDC on Base and setting FITTINGS_PRIVATE_KEY (0x...) so the provided client can pay the quote. Those instructions and the off-chain signing/settlement flow are direct crypto payment capabilities (wallet private key, signing authorizations, facilitator settlement), which grant the agent the ability to execute financial transactions.