airport-nearby

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The bundled client (call.mjs) performs runtime fetches to the fittings.sh gateway (e.g., https://fittings.sh and its /catalog and /skill paths such as https://fittings.sh/skill/call.mjs and https://fittings.sh/catalog/airport.nearby) and uses the returned JSON (service metadata, pricing, and payment challenge) to determine what requests to make and how to perform the payment handshake, so remote content from fittings.sh directly controls the client's behavior at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill's client includes an explicit payment flow that requires signing with a private key and spending USDC on Base. The docs show a 402 Payment Required flow, instruct the user to set FITTINGS_PRIVATE_KEY and run the client to authorize/payment, and advise using a wallet holding USDC. This is a specific crypto payment integration (wallet signing/settlement), not a generic API caller, so it grants direct financial execution capability.