calc-evaluate

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). One URL (https://fittings.sh/skill/call.mjs) is a direct link to a remote executable script the docs instruct you to curl and run — a common malware distribution pattern from an unverified domain — so the set is suspicious for that reason.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes on-chain/crypto payment authorization: it returns a signed quote and requires the client to sign an authorization using a private key (FITTINGS_PRIVATE_KEY), mentions holding USDC on Base, and references EVM tooling (@x402/evm). The call flow and example show the agent/client can sign and authorize real payments (facilitator then settles). This is a specific blockchain wallet/payment integration (not a generic API), so it grants direct financial execution capability.