census-geocode-batch

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires signing a payment and retrying with a PAYMENT-SIGNATURE header and references a FITTINGS_PRIVATE_KEY kept in plaintext, which forces inclusion of signature/private-key material verbatim in requests (high exfiltration risk).

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The skill instructs users to download and run a script directly (https://fittings.sh/skill/call.mjs), which is an executable code artifact from a third‑party host and therefore a potential malware distribution vector.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a payment flow requiring the client to sign an authorization and supply a PAYMENT-SIGNATURE header (402 flow), references storing a private key (FITTINGS_PRIVATE_KEY), and instructs using a wallet with USDC on Base; it even points to @x402/evm and signing libraries. These are concrete crypto/payment actions (signing and authorizing on-chain/off-chain payments), not generic HTTP or browsing, so the skill grants direct financial execution capability.