nhtsa-vin-decode

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The site hosts and explicitly instructs users to download and run a remote Node script (https://fittings.sh/skill/call.mjs) from an unvetted domain, which is a common vector for delivering malicious code even though the API endpoints themselves look benign.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a crypto payment flow: it documents a "Paying" process where the endpoint returns a 402 quote that the client "sign[s] an authorization," shows running call.mjs with FITTINGS_PRIVATE_KEY set, references a wallet holding USDC on Base, and mentions @x402/evm and off-chain signing/facilitator settlement. These are concrete instructions and mechanisms for signing and executing payments with a crypto wallet (direct financial execution), not just a generic API caller.