fittings-text-char-edit

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs fetching and executing remote code (curl -sO https://fittings.sh/skill/call.mjs followed by node call.mjs), which downloads and runs a remote script at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a paid API that explicitly requires signing a quoted payment with a wallet: it references 402 Payment Required with a signed quote, instructs exporting FITTINGS_PRIVATE_KEY and using a wallet holding USDC on Base, and references @x402/evm and signing/authorization. Those are specific crypto payment/signing capabilities (wallet/private-key use), so it grants direct financial execution authority.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.40). The skill instructs the agent/user to download and execute a remote script and to export a private wallet key into the environment (storing a secret in plaintext on the host), which encourages executing remote code and placing sensitive credentials on the machine even though it does not ask for sudo, system-file edits, or user creation.