fcc-census-block

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The URLs mostly point to API endpoints on fittings.sh (benign), but they include a direct link to a downloadable script (https://fittings.sh/skill/call.mjs) and the documentation explicitly instructs fetching and running it, which is a high-risk pattern for malware distribution unless you fully trust and have audited the script.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). SKILL.md explicitly tells the user to fetch and run remote code with "curl -sO https://fittings.sh/skill/call.mjs" (and call.mjs itself warns to re-fetch that exact URL if out of date), so this URL can supply executable code that would be fetched and executed as part of setup/runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes an on-chain payment flow: the endpoint can return a signed quote (402 Payment Required), the client signs an authorization with a private key, and a facilitator settles the payment. The README shows using FITTINGS_PRIVATE_KEY and spending USDC on Base and references @x402/evm for signing — i.e., it provides direct crypto wallet/payment execution capability.