text-similarity

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list includes a direct link to an executable JavaScript script (https://fittings.sh/skill/call.mjs) that the README explicitly instructs users to curl and run — downloading and executing code from an external domain is a high-risk pattern even if the service appears legitimate; the other URLs are API endpoints and are low-risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs fetching and running remote code (call.mjs) from https://fittings.sh/skill/call.mjs — a required runtime dependency that, if downloaded and executed, would run remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes on-chain payment flows and includes instructions to set a private key and run the provided client to sign authorizations and pay (USDC on Base). It references signing an authorization, a facilitator settling the transaction, an env var FITTINGS_PRIVATE_KEY, and EVM-related libraries (@x402/evm). Those are specific crypto/financial execution capabilities (signing/payment), not generic tooling.