fittings-semver-range-resolve

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The site hosts API/docs, but the direct download https://fittings.sh/skill/call.mjs is an executable JavaScript module the README instructs you to fetch and run (including supplying a private key), which matches high-risk distribution patterns for malware delivery.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The documentation instructs fetching and executing remote code at runtime via "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", which downloads and runs remote JavaScript from https://fittings.sh/skill/call.mjs.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit crypto payment/invoicing behavior: it returns a signed quote (402), requires signing an authorization, and describes using a wallet holding USDC on Base with a FITTINGS_PRIVATE_KEY to cause settlement. It references client libraries (@x402/evm), signing/re-signing challenge responses, and environment variables that enable on‑call spending. These are specific crypto/Blockchain payment mechanisms (wallet signing and settlement), which constitute direct financial execution capability.