quake-recent

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The domain hosts API endpoints that look benign, but https://fittings.sh/skill/call.mjs is a direct downloadable script which the skill instructs you to curl and run—downloading and executing code from an external site is high-risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime workflow (call.mjs) reads and ingests free-text only from first-party/queried service responses (e.g., /catalog/... and the quoted 402 terms header/body, plus the HTTP response body), and it does not automatically consume outsider-authored content submitted into a monitored feed/queue.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL.md explicitly instructs fetching and running remote code via "curl -sO https://fittings.sh/skill/call.mjs", which would download and execute external code required by the skill.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit on‑chain/crypto payment flow: the endpoint returns a signed quote and the client must sign an authorization to pay (examples show exporting FITTINGS_PRIVATE_KEY and running node call.mjs). It references USDC on Base, off‑chain signing, a facilitator that settles/gas that broadcast, and npm packages (@x402/evm) for signing — i.e. concrete wallet/transaction signing capability to spend funds. This is direct financial execution via crypto signing, not a generic capability.