fittings-text-similarity

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). One URL (https://fittings.sh/skill/call.mjs) is a direct downloadable script the doc explicitly tells you to curl and execute with node, which is a high-risk pattern for malware distribution from an unverified domain.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and executing remote code via "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", so https://fittings.sh/skill/call.mjs is a runtime external dependency that executes fetched code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit crypto payment integration: it describes a paid endpoint that returns a signed quote which the caller must sign (authorization), references a wallet holding USDC on Base, shows exporting a private key (FITTINGS_PRIVATE_KEY=0x...), and mentions @x402/evm. Those are concrete wallet/signing/payment mechanics (crypto signing of payments), which constitute direct financial execution capability.