energy-uk-carbon-intensity

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The package includes an explicit curl download of a runnable JavaScript module (https://fittings.sh/skill/call.mjs) and instructs users to fetch-and-run it from a non-well-known third‑party domain, which is a distribution pattern commonly used to deliver untrusted executables and thus poses a moderate risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). call.mjs and the skill documentation perform runtime fetches to https://fittings.sh (e.g. GET https://fittings.sh/v1/energy/uk-carbon-intensity and catalog endpoints, and suggest curl -sO https://fittings.sh/skill/call.mjs) to obtain service metadata and payment terms that directly influence the client's behavior and are required for the skill to run.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a paid call flow that requires signing an on‑chain-style payment authorization with a private key (FITTINGS_PRIVATE_KEY), references holding USDC on Base, and mentions EVM tooling (@x402/evm). It describes receiving a 402 with a signed quote, signing an authorization, and a facilitator settling the payment — i.e., the client signs to trigger real monetary spend. These are specific crypto/payment instructions (wallet private key export, signing, spending USDC), so the skill grants direct financial execution capability.