solar-twilight-windows

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The skill instructs users to download and run an unsigned JavaScript CLI directly from https://fittings.sh (curl -sO https://fittings.sh/skill/call.mjs) — fetching and executing scripts from an unverified service is a high-risk pattern for malware delivery.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit on‑chain/crypto payment flow: it returns a 402 with a signed quote which the client must sign, shows setting FITTINGS_PRIVATE_KEY to authorize payment, references USDC on Base and evm signing libraries, and describes automatic settlement and spending caps. These are specific crypto/payment operations (wallet private key use and signing), so the skill grants direct financial execution capability.