time-public-holidays

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The URL https://fittings.sh/skill/call.mjs is a direct downloadable script that the skill explicitly instructs users to curl and run, which is a high-risk pattern (remote code execution) while the other listed endpoints are normal API/catalog endpoints and are low risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a paid endpoint that issues a signed quote and requires the client to sign an authorization with a private key to pay. It shows concrete crypto payment integration: commands referencing FITTINGS_PRIVATE_KEY, a wallet holding USDC on Base, and npm packages like @x402/evm. This is a specific crypto/payment execution flow (signing transactions/authorizations to spend funds), so the skill grants direct financial execution capability.