fittings-pkg-name-check

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The skill instructs users to curl and execute a remote JavaScript (call.mjs) and to supply a plaintext private key in the environment—downloading and running an externally hosted script with wallet credentials is a high-risk pattern that can enable arbitrary code execution and credential exfiltration.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The document explicitly instructs fetching and executing remote code via "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", meaning https://fittings.sh/skill/call.mjs is fetched at runtime and executed.