fittings-sam-exclusions-check

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The list includes a direct download link to a JavaScript module (call.mjs) that the skill instructs you to fetch and execute with node—downloading and running executable scripts from an unvetted domain is a high-risk pattern for malware distribution; the other URLs are API/catalog endpoints.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs fetching and running remote code ("curl -sO https://fittings.sh/skill/call.mjs" then "node call.mjs"), so https://fittings.sh/skill/call.mjs is a runtime dependency whose fetched content is executed.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a paid API client that explicitly requires and describes on-chain/crypto payment operations: it mentions pricing, a 402 "Payment Required" flow with a signed quote, signing an authorization, a facilitator settling the transaction, and examples that set FITTINGS_PRIVATE_KEY and a wallet holding USDC on Base. It also references EVM-related client libraries (@x402/evm) and signing requirements. These are specific crypto/wallet signing/payment mechanisms — not generic tooling — so this grants direct financial execution capability.