fec-candidate-search

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs fetching and executing remote code (curl -sO https://fittings.sh/skill/call.mjs) as a required/installation runtime step, so the URL supplies code that would be executed by the operator.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly supports on-chain/crypto payments: it describes receiving a "402 Payment Required" with a signed quote, signing an authorization, and settling via a facilitator. It instructs setting FITTINGS_PRIVATE_KEY, using a wallet holding USDC on Base, and shows a command that will sign and pay. This is a specific crypto payment flow (wallet signing, private key use, EVM/npm libs), not a generic API caller or browser automation.