ctgov-trial-search

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). One or more of the URLs point to a downloadable executable script (https://fittings.sh/skill/call.mjs) that the skill explicitly instructs you to curl and run—downloading and executing remote scripts from non‑widely‑known domains is a high risk even if the other endpoints are ordinary APIs.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a paid calling flow that requires signing a payment authorization with an on-chain wallet private key (export FITTINGS_PRIVATE_KEY=0x...), uses USDC on Base, and references @x402/evm for signing. The client will sign quotes and a facilitator settles funds; this is a specific crypto payment/wallet integration (not a generic HTTP caller), so the skill grants direct financial execution capability.