nws-area-alerts

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The documentation instructs users to fetch and execute a raw script (https://fittings.sh/skill/call.mjs), which is a common malware distribution vector even though the other URLs are just API/catalog endpoints on the same host.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit, crypto-based payment and signing functionality: it describes a "402 Payment Required" flow with a signed quote, instructs setting FITTINGS_PRIVATE_KEY (example: 0x...), references a wallet holding USDC on Base, and cites evm-related libraries (@x402/evm). These are specific tools for signing authorizations and spending crypto funds, which constitutes Direct Financial Execution capability.