time-compute

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). scripts/call.mjs sets BASE to "https://fittings.sh" and at runtime fetches the catalog, service records and a /skill/call.mjs.sha256 from that host, so remote JSON from https://fittings.sh directly determines the service endpoints, input schemas and requests the tool will execute.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly supports and requires on-chain payment: it instructs using USDC on Base, requires a spending wallet private key set as FITTINGS_PRIVATE_KEY (exported as an env var), describes an off-chain signature authorizing a USDC transfer and the facilitator submitting the transaction. These are specific crypto payment controls (wallet/private-key-driven transfers), i.e. direct financial execution capability.