geo-reverse-geocode

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This skill instructs fetching and running a remote JavaScript module (https://fittings.sh/skill/call.mjs) from an external, non-standard domain — a direct script download you are told to execute, which is a high-risk pattern for malware or supply-chain compromise.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes an on-chain/crypto payment flow: the API may return a 402 with a signed quote that the client must sign using a private key (FITTINGS_PRIVATE_KEY). The docs instruct using a wallet holding USDC on Base and show command examples that sign authorizations to pay. This is explicit wallet signing/crypto payment functionality (Direct Financial Execution).