fittings-text-extract-citations

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The URL https://fittings.sh/skill/call.mjs is a direct downloadable script that the skill instructs users to run (including setting a private key), which matches high-risk indicators for distributing executables/scripts to be executed by users.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In text.extract-citations (POST https://fittings.sh/v1/text/extract-citations), the runtime ingests the outsider-supplied text field (free text up to 200000 characters) directly for identifier extraction.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The document instructs fetching and executing remote code via "curl -sO https://fittings.sh/skill/call.mjs" and then running it with "node call.mjs", which downloads and runs external code at runtime (https://fittings.sh/skill/call.mjs).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation includes an explicit payment flow that requires supplying a private key and will sign an authorization to settle a quoted payment in USDC on Base via a facilitator. It provides example commands (export FITTINGS_PRIVATE_KEY, node call.mjs) and notes the client will sign and spend funds. These are specific crypto payment instructions (wallet/private-key usage and token spending), which constitute direct financial execution capability.