fittings-sec-company-facts

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The package directs users to download and run an executable script (call.mjs) from a non-standard domain and explicitly instructs running it with Node — a common malware distribution pattern for remote scripts—so this is suspicious unless you fully trust the source and have audited the code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes explicit runtime instructions to download and execute remote code (curl -sO https://fittings.sh/skill/call.mjs followed by node call.mjs), so https://fittings.sh/skill/call.mjs is a fetched dependency that will execute when run.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a payment flow and crypto wallet signing: it describes a 402 "Payment Required" quote that you sign, requires a wallet holding USDC on Base, and shows setting FITTINGS_PRIVATE_KEY to authorize/pay. The client can sign and settle payments (with FITTINGS_MAX_PRICE cap), so the skill provides direct financial execution (cryptocurrency wallet signing/payment) capability.