crypto-hash-digest

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). One URL is a direct download of an executable JavaScript (call.mjs) from a non-standard site — downloading and running such a script can execute arbitrary code and is a common malware delivery vector, while the other links are API/catalog endpoints.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit crypto payment flow: the endpoint returns a 402 signed quote and the client must sign an authorization with a private key to pay. The doc instructs using a wallet holding USDC on Base, setting FITTINGS_PRIVATE_KEY, and describes signing/settlement and EVM helpers (@x402/evm). These are specific blockchain wallet/signing/payment instructions (direct financial execution capability).