epa-tri-facilities

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The skill instructs users to download and run a JavaScript executable directly from an unverified domain (curl -sO https://fittings.sh/skill/call.mjs) and the code handles sensitive keys and payments, so fetching and executing that remote script from this non-official source represents a high-risk action.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates a crypto payment flow: the endpoint returns a signed quote and the client must sign an authorization with a private key (FITTINGS_PRIVATE_KEY). It instructs using a wallet holding USDC on Base, describes signing and settlement via a facilitator, and references EVM/npm libraries. These are specific crypto/transaction actions that enable on‑behalf spending, so this grants direct financial execution capability.