fittings-time-business-days

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Most URLs are API endpoints and likely benign, but https://fittings.sh/skill/call.mjs is a direct download of a JavaScript executable that the doc explicitly instructs you to run (and to supply a private key), which is risky because such scripts can exfiltrate secrets or perform malicious actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill README explicitly instructs fetching and executing remote JavaScript (curl -sO https://fittings.sh/skill/call.mjs then node call.mjs), which downloads and runs remote code at runtime: https://fittings.sh/skill/call.mjs

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a paid endpoint that requires on-chain-style payment authorization: it describes receiving a 402 signed quote, "you sign an authorization", and shows exporting FITTINGS_PRIVATE_KEY and using a wallet holding USDC on Base. It explicitly references signing, an EVM helper package (@x402/evm), and settling payments — i.e., crypto wallet signing/spending functionality. This is a specific crypto payment flow (wallet/private-key signing), so it grants direct financial execution capability.