semver-range-resolve

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The skill instructs downloading and running a remote JavaScript executable (call.mjs) from fittings.sh, which is a direct executable script to run locally and therefore poses a higher risk unless you fully trust the source.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid API flow that requires signing authorizations with an on-chain wallet/private key (export FITTINGS_PRIVATE_KEY=0x...), mentions a wallet holding USDC on Base, and a facilitator that settles payments. It provides concrete instructions and libraries (@x402/evm) for performing the signing/settlement, so this is a specific crypto payment integration (wallet signing/spending) — i.e., direct financial execution capability.