dailymed-spl-fetch

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The URL https://fittings.sh/skill/call.mjs is a direct downloadable Node script the docs instruct users to curl and run (running arbitrary remote scripts is a high-risk vector); the other listed links are API/catalog endpoints and not direct downloads.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). SKILL.md tells the user to fetch and then run remote code ("curl -sO https://fittings.sh/skill/call.mjs" and then "node call.mjs"), so the URL https://fittings.sh/skill/call.mjs is a runtime-installable remote script that would be executed and is required if the local copy is missing.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly supports paid calls that require signing an authorization with a private key and a wallet holding USDC on Base. The docs show setting FITTINGS_PRIVATE_KEY and running the client to make a real (paid) call, describe signing a quote and a facilitator settling the payment, and warn about spending and wallet safety. These are explicit crypto/payment execution capabilities (wallet signing, spending USDC, facilitator broadcast), so this grants direct financial execution authority.