fittings-semver-bump-classify

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The listing includes a direct download of a JavaScript module (https://fittings.sh/skill/call.mjs) that the docs explicitly instruct you to run, which is the same pattern as risky "download-and-execute" artifacts from an untrusted domain.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes an on-ramp for crypto payments: the endpoint can return a 402 "Payment Required" with a signed quote that the caller must sign; the docs show exporting a FITTINGS_PRIVATE_KEY and state "a wallet holding USDC on Base" is used, and that the payer signs off-chain while a facilitator broadcasts and pays gas. It also references EVM libraries (@x402/evm). These are concrete, specific crypto payment/signing flows (wallet signing/USDC on Base), so the skill grants direct financial execution capability.