geo-forward-geocode

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The skill instructs users to download and run a remote script (curl -sO https://fittings.sh/skill/call.mjs), which is a high-risk distribution pattern for malware because executing code fetched directly from an unverified host can run arbitrary malicious actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). call.mjs and the skill documentation fetch service metadata and payment challenges at runtime from https://fittings.sh (e.g., https://fittings.sh/catalog/geo.forward-geocode and the service endpoint https://fittings.sh/v1/geo/forward-geocode and suggest fetching https://fittings.sh/skill/call.mjs), and that fetched content directly controls the client's behavior (input schema, endpoint, and payment handshake) which the skill requires to run.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid API flow that requires signing an authorization with a crypto wallet: it documents exporting FITTINGS_PRIVATE_KEY, mentions USDC on Base, off-chain signing, a 402 signed quote, and links to EVM/npm libs (@x402/evm). These are specific crypto/payment operations (wallet signing) — i.e., direct financial execution capability.