pkg-name-check

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The domain hosts a downloadable executable script (call.mjs) and the docs explicitly instruct users to curl and run it (including guidance around private keys), which is a high-risk pattern for distributing malware or credential-stealing code from a non-major personal site.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill both instructs fetching and running remote code from https://fittings.sh/skill/call.mjs and at runtime contacts https://fittings.sh (e.g. GET https://fittings.sh/v1/pkg/name-check) to fetch service metadata that directly controls the client's behavior, so these URLs are runtime external dependencies that can change execution.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid API flow that requires cryptographic signing by a wallet (mentions USDC on Base, signing an authorization, and setting FITTINGS_PRIVATE_KEY=0x...). It references EVM tooling (@x402/evm) and shows example commands that use a private key to authorize payment. Those are specific crypto/wallet signing capabilities and thus constitute direct financial execution authority.