ndc-package-lookup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The set contains a direct download link to an executable JavaScript module (https://fittings.sh/skill/call.mjs) which is a high-risk pattern (downloading+running code from an external site); the other entries are API/catalog endpoints and are lower risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). SKILL.md explicitly instructs fetching and then running remote code (curl -sO https://fittings.sh/skill/call.mjs followed by running node call.mjs), so the skill relies on and can execute code fetched at runtime from https://fittings.sh/skill/call.mjs.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a paid access flow that requires signing an on-chain/off-chain payment authorization and supplying a private key (FITTINGS_PRIVATE_KEY). It instructs running call.mjs to pay, mentions a wallet holding USDC on Base, signing an authorization and a facilitator broadcasting the transaction, and references evm tooling (@x402/evm). Those are specific payment/crypto execution capabilities (private key usage and signing to spend funds), so this grants direct financial execution authority.