noaa-coops-station-data

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The SKILL instructs users to fetch and run a remote executable JavaScript module (https://fittings.sh/skill/call.mjs), which is a high-risk pattern (remote code execution) even though the other listed URLs are API/catalog endpoints.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid API flow that requires signing an on‑chain authorization with a wallet private key (FITTINGS_PRIVATE_KEY), uses USDC on Base, references @x402/evm and a facilitator that broadcasts transactions, and provides example commands that perform real payments. This is a specific crypto/payment execution capability (signing/spending funds), not a generic API caller, so it grants Direct Financial Execution Authority.