sec-company-filings

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The skill explicitly instructs users to download and run an executable JavaScript file (https://fittings.sh/skill/call.mjs) from an external host — a direct-download + "run this" pattern from an unverified domain is a high-risk malware distribution vector.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the runner to fetch and execute remote code with curl -sO https://fittings.sh/skill/call.mjs (if call.mjs is missing), which downloads a script that would be run (remote code execution risk).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit crypto payment flow: the client can sign an authorization with a private key (FITTINGS_PRIVATE_KEY), uses USDC on Base, and references x402/evm libraries. It instructs running the client with a wallet private key to pay quoted fees (export FITTINGS_PRIVATE_KEY=0x...; node call.mjs), and describes signing and settling payments. This is a specific mechanism to authorize and spend funds (crypto), so it grants direct financial execution capability.