usda-food-nutrients

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The package instructs downloading and running a remote JavaScript executable (call.mjs) from an unvetted personal domain (fittings.sh), which is a high-risk pattern because it’s a direct remote script download and explicitly told to be fetched/run.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes a payment flow using a crypto wallet: the endpoint returns a signed quote (402), the client must sign an authorization, and a facilitator settles it. It shows a concrete example of setting FITTINGS_PRIVATE_KEY (an EVM private key), instructs using USDC on Base, and references EVM/npm signing libraries. These are specific crypto payment instructions enabling the agent to sign and authorize real payments.