solar-sun-position

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The skill instructs users to curl and fetch an executable script (https://fittings.sh/skill/call.mjs) from a third‑party domain — a direct-download-of-code pattern that is a high-risk distribution vector for malware when the source is not an established vendor/CDN.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). call.mjs at runtime only ingests provider-trusted free text from its own fetched JSON/schema endpoints and the response body returned by the fittings.sh service for a user-specified service invocation (no browsing of arbitrary outsider-authored content), and it does not read from user-supplied queues/inboxes/feeds.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit, built-in payment flow that requires and uses a crypto wallet/private key to authorize and settle requests (mentions setting FITTINGS_PRIVATE_KEY, USDC on Base, signing an authorization, facilitator broadcasting gas, and helper EVM packages). This is concrete crypto payment/signing capability (wallet signing / spending), so it grants direct financial execution authority.