cve-search

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The set includes a direct downloadable executable script (https://fittings.sh/skill/call.mjs) hosted on a small personal/service domain with explicit curl/install instructions — fetching and running such remote scripts is a common malware distribution pattern even though the other endpoints are normal API calls.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a metered payment flow and shows how to sign authorizations with a private key to pay in USDC on Base (examples using FITTINGS_PRIVATE_KEY, instructions to "For real: a wallet holding USDC on Base", and mention of signing a quote and facilitator settlement). This is a specific crypto payment integration (off-chain quote signing / on-chain settlement via a wallet), not a generic API caller or browser automation, so it grants direct financial execution capability.