lei-hierarchy

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs instruct users to curl and run a remote JavaScript module from an unvetted domain (fittings.sh), which is a high-risk pattern for covert malware distribution.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a paid calling flow that requires supplying a private key (FITTINGS_PRIVATE_KEY), signing an authorization to settle a quoted price, and using a wallet holding USDC on Base. It references signing, an EVM helper (@x402/evm), and facilitator settlement — i.e. concrete crypto payment/wallet signing functionality. This is a specific crypto/financial execution capability, not a generic API caller.