fittings-quake-recent

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The URL https://fittings.sh/skill/call.mjs is a direct download of a JavaScript module that the docs explicitly instruct users to curl and execute (node call.mjs), which is risky because running remote scripts from an unverified source can execute arbitrary code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and executing remote code with "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", which downloads and runs external JavaScript at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid API flow that requires the caller to sign an authorization with a crypto wallet private key (FITTINGS_PRIVATE_KEY), mentions holding USDC on Base, and provides a call client (call.mjs) and evm-related libraries. These are specific crypto payment instructions (signing/payments) rather than generic API access, so the skill grants direct financial execution capability.