fittings-road-nearest

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The site hosts a directly downloadable script (https://fittings.sh/skill/call.mjs) that the skill instructs users to curl and run with Node — combined with advice to export a plaintext private key, this "download-and-run" pattern from an unverified domain is a high-risk distribution vector for malware or credential theft.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill documentation instructs fetching and executing remote JavaScript via "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", which clearly downloads and runs remote code at runtime (https://fittings.sh/skill/call.mjs).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid API flow that requires signing an on‑chain/off‑chain authorization with a wallet: it mentions "402 Payment Required" with a signed quote, instructs setting FITTINGS_PRIVATE_KEY, shows a wallet holding USDC on Base, and describes automatic settlement and caps (FITTINGS_MAX_PRICE). Those are explicit crypto payment/signing capabilities (wallet/private key usage) that enable the agent to authorize spending—i.e., direct financial execution.