swpc-space-weather-scales

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs include an instruction to download an executable JavaScript module (call.mjs) from an external, unverified host — fetching and running remote scripts is a common malware vector.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs fetching and running remote code at https://fittings.sh/skill/call.mjs (curl -sO https://fittings.sh/skill/call.mjs), which is a required runtime script that would execute remote JavaScript on the host.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documents an explicit paid call flow that requires signing an authorization with a crypto wallet: it describes receiving a 402 quote, signing an authorization, example commands that set FITTINGS_PRIVATE_KEY, instructs using a wallet holding USDC on Base, and references libraries (@x402/evm) for EVM signing. These are specific crypto payment/signing instructions (wallet/private-key use and signing), which grant direct financial execution capability.