fittings-usda-food-nutrients

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include a direct download link to a JavaScript module (https://fittings.sh/skill/call.mjs) that the document explicitly instructs users to curl and run with node, which is high-risk because executing an unreviewed remote script can deliver malware or perform harmful actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill directly instructs fetching and executing remote code with "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", so https://fittings.sh/skill/call.mjs is a runtime external dependency that executes remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a payment flow that requires a crypto wallet and private key: it returns a signed quote (402 Payment Required), expects the client to sign an authorization, and shows commands that set FITTINGS_PRIVATE_KEY and run call.mjs to pay with USDC on Base. It also references EVM-related client libraries (@x402/evm) and signing behavior. These are specific crypto payment instructions (wallet/private-key use and signing), so the skill enables direct financial execution.