fittings-valid-lei

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The skill instructs downloading and running a remote JavaScript module (https://fittings.sh/skill/call.mjs) from an unverified domain — a direct executable fetch-and-run pattern that is a high-risk vector for malware.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit crypto payment flow: the endpoint returns a 402 with a signed quote that the client must sign to authorize payment, instructions to set FITTINGS_PRIVATE_KEY (a private key) and to hold USDC on Base, and references to EVM-related client libraries (@x402/evm). These are concrete wallet/crypto signing/payment details (not generic HTTP or browser automation) and enable the agent to sign authorizations that cause real payments — i.e., direct financial execution.