fittings-vat-eu-validate

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The skill instructs downloading and executing a remote JavaScript module (call.mjs) from an external domain — running untrusted scripts is a high-risk distribution vector for malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes an explicit runtime step that downloads and executes remote code (curl -sO https://fittings.sh/skill/call.mjs followed by node call.mjs), so the URL https://fittings.sh/skill/call.mjs is a runtime external dependency that will execute fetched code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill's docs explicitly describe an integrated payment flow that requires a private key and signing authorizations: the endpoint returns a 402 with a signed quote, the client signs an authorization (exporting FITTINGS_PRIVATE_KEY is shown), and a facilitator settles the payment using USDC on Base. The doc even warns about wallet contents, FITTINGS_MAX_PRICE auto-payment cap, and references EVM-related client libraries. These are explicit crypto payment/signing capabilities (wallet signing/authorization), i.e., direct financial execution authority.