nhtsa-safety-ratings

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The listed API endpoints appear to be JSON service URLs, but the skill explicitly advises downloading and running a JavaScript module directly from an unvetted domain (https://fittings.sh/skill/call.mjs), which is a risky "curl-and-run" pattern and raises suspicion.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a payable endpoint that returns a signed quote and requires the client/agent to sign an authorization with a wallet/private key to settle (USDC on Base). It shows usage by exporting FITTINGS_PRIVATE_KEY and running the client to perform a real payment, and references client libraries for EVM signing. This is direct crypto transaction/signing capability (wallet/private-key-based execution), which meets the criteria for Direct Financial Execution.