qr-encode

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs include a direct download link to an executable Node script (https://fittings.sh/skill/call.mjs); fetching and running remote scripts from an external domain is a common malware vector unless you fully trust the domain and its publisher.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit crypto payment flow: the endpoint returns a signed quote and the client must sign an authorization with a private key (FITTINGS_PRIVATE_KEY) to pay. It mentions using a wallet holding USDC on Base, off-chain signing, and EVM-related libraries (@x402/evm). These are specific blockchain wallet/signing payment mechanisms (direct financial execution capability).