govinfo-us-code-section

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The skill explicitly tells the user to curl and run a remote .mjs Node script (https://fittings.sh/skill/call.mjs), which is a direct remote-code-execution/download of an executable script from a third‑party domain and therefore a potentially high-risk distribution vector; the other listed URLs are API endpoints, not installers.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's README explicitly instructs fetching and then running remote code ("curl -sO https://fittings.sh/skill/call.mjs"), so the URL https://fittings.sh/skill/call.mjs can deliver code that would be executed at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly requires and documents signing payments with a crypto wallet to use the paid endpoint: it returns a 402 quote, instructs the client to sign an authorization, shows setting FITTINGS_PRIVATE_KEY and running node call.mjs (with a wallet holding USDC on Base), references @x402/evm, and describes facilitator settlement and broadcasting. These are specific crypto payment instructions (wallet signing and on‑chain settlement), i.e., direct financial execution capability.