epa-tri-releases

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include an instruction to curl and run a remote script (https://fittings.sh/skill/call.mjs) which is an executable module that can perform payments and access a private key—downloading and executing such a script from the network is a high-risk pattern even if the domain appears legitimate.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit crypto payment flow: the endpoint can return a 402 with a signed quote that the client must sign, and the docs show a real payment example requiring a private key (FITTINGS_PRIVATE_KEY) and USDC on Base. It describes signing authorizations and using @x402/evm, i.e. direct blockchain/crypto transaction signing — this is a specific financial execution capability.