pkg-normalize-manifest

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs include a direct link to an executable JavaScript module (https://fittings.sh/skill/call.mjs) hosted on a non-major domain — fetching and running remote scripts is a common malware vector and should be treated as potentially risky unless you trust the source and verify integrity.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit, non-generic payment flow that requires cryptographic signing and use of a wallet: the endpoint returns a 402 quote, the client must "sign the authorization" and retry with a PAYMENT-SIGNATURE header, the doc warns about storing a private key (FITTINGS_PRIVATE_KEY), and it references USDC on Base and @x402/evm for EVM signing. These are concrete crypto payment/signing integrations (wallet signing and settlement), which constitute direct financial execution capability.