fittings-usda-food-search

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include a direct download of an executable JavaScript module (https://fittings.sh/skill/call.mjs) that the document explicitly instructs you to curl and run with node from an untrusted/unknown domain, which is a high-risk pattern for malware or malicious scripts.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs users to run "curl -sO https://fittings.sh/skill/call.mjs" and then "node call.mjs", which fetches remote JavaScript and executes it at runtime (https://fittings.sh/skill/call.mjs).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid call flow that requires a crypto wallet: it returns a 402 with a signed quote that "you sign an authorization", shows running a client with FITTINGS_PRIVATE_KEY, and specifies a wallet holding USDC on Base. It instructs exporting a private key and describes off-chain signing and facilitator settlement. This is a specific crypto/wallet signing/payment flow (direct financial execution capability), not a generic API caller.