fittings-pkg-normalize-manifest

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). One URL is a direct link to a JavaScript module (https://fittings.sh/skill/call.mjs) on an otherwise non‑well‑known domain which could be fetched and executed, making it a potentially risky download/execution vector.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly requires and describes on-chain crypto payment flows: it returns a 402 signed quote, asks the caller to sign an authorization and retry with a PAYMENT-SIGNATURE header, recommends using a wallet with USDC on Base, references @x402/evm, and discusses signing and facilitator settlement. These are specific crypto/payment execution capabilities (wallet signing, payment authorization), not generic functionality.