drought-severity

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs point to a custom domain that includes a direct download of an executable script (https://fittings.sh/skill/call.mjs) and the docs explicitly instruct users to curl and run it — downloading and executing scripts from an unverified third-party host is a security risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a metered payment flow that requires a crypto wallet/private key: it returns a 402 with a signed quote, the client must "sign an authorization", and the example shows setting FITTINGS_PRIVATE_KEY and running call.mjs to actually pay with USDC on Base. It also references EVM-related packages (@x402/evm) and explains off-chain signing and settlement. These are specific crypto payment instructions (wallet signing and spending), which grant direct financial execution capability.