fittings-water-noaa-tides

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include an instruction to download and execute a JavaScript client (call.mjs) from an unverified domain and to supply a private key in the environment — downloading and running such a script poses a high risk of credential/theft or arbitrary code execution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime install instructions explicitly download and then execute remote JavaScript via "curl -sO https://fittings.sh/skill/call.mjs" followed by "node call.mjs", meaning remote code from https://fittings.sh/skill/call.mjs would be fetched and executed at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly requires and describes on-chain/crypto payment actions: it returns a 402 with a signed quote that the client must sign, references putting a private key in FITTINGS_PRIVATE_KEY and using a wallet holding USDC on Base, and points to EVM helper packages (@x402/evm). These are specific mechanisms to authorize and execute payments (signing transactions/authorizations and using a wallet), so this grants Direct Financial Execution capability.