fec-financial-totals

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime fetches service metadata and endpoints from the fittings gateway (e.g. https://fittings.sh/catalog/fec.financial-totals and the base https://fittings.sh), and that fetched JSON (service.input, service.endpoint, pricing/terms) directly controls what arguments are required and how the client behaves at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly supports on-chain/off-chain payment authorization: the endpoint returns a 402 quote which the client signs, and the docs show using a wallet private key (FITTINGS_PRIVATE_KEY) and a USDC-on-Base wallet to pay. It describes signing an authorization and settling funds (facilitator broadcasts gas), and warns the key sits in plaintext. This is a specific crypto/payment integration (wallet signing) that enables spending, so it grants direct financial execution capability.