time-business-days

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The documentation instructs users to curl and run an external script (https://fittings.sh/skill/call.mjs), which is a direct downloadable executable script and therefore a high-risk distribution vector even though other endpoints are API/documentation.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill requires holding and using a crypto wallet key to authorize payment for calls. The docs describe a 402-signed-quote flow where the client must sign an authorization with FITTINGS_PRIVATE_KEY, use USDC on Base, and references EVM signing libraries (@x402/evm). That is an explicit crypto wallet/signing payment flow, which grants the ability to sign/pay (direct financial execution) if an agent is given the private key.