pdb-structure

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs exporting a private key into an environment variable (showing an export FITTINGS_PRIVATE_KEY=0x... example) and notes the key "sits in plaintext", which encourages handling secrets in cleartext and could cause an agent to include the secret verbatim in commands or outputs.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The SKILL instructs downloading and running an executable Node script (call.mjs) from an external domain — a high-risk pattern because arbitrary remote scripts can contain malware or backdoors.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit on-chain payment flow: the endpoint can return a 402 quote that the client must sign, it documents using a private key (FITTINGS_PRIVATE_KEY), requires a wallet holding USDC on Base, and references EVM-related client libraries (@x402/evm). Those are specific crypto wallet/signing instructions enabling payment authorization rather than being mere generic HTTP or browser calls.