sec-company-facts

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs point to a third‑party API host that instructs users to download and run a remote script (https://fittings.sh/skill/call.mjs), which is a high‑risk pattern because running fetched executables/scripts from an external site can distribute malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs fetching and then running remote code via the command curl -sO https://fittings.sh/skill/call.mjs, which downloads executable JavaScript the client may run, so that URL is a runtime external dependency that can execute code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit crypto payment flow: it instructs supplying a private key (export FITTINGS_PRIVATE_KEY=0x...), references a wallet holding USDC on Base, describes signing an authorization to pay a quoted invoice, and points to @x402/evm tooling. Those are concrete instructions to authorize on-chain/crypto payments (wallet signing), so the skill enables direct financial execution.