faers-adverse-events

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The skill instructs fetching and running a JavaScript executable directly from a third‑party domain (https://fittings.sh/skill/call.mjs), which is a common malware-distribution pattern and should be treated as suspicious unless you fully trust and have audited the code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill describes a metered paid API that requires signing an authorization with a private key and using a wallet (USDC on Base). It shows example use of FITTINGS_PRIVATE_KEY, explains the client will sign a quote and a facilitator settles the payment, and gives operational details about spending, caps, and wallet handling. This is an explicit crypto payment flow (wallet signing / spending), i.e. direct financial execution capability.