weather-nws-point-forecast

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs point to a personal/service domain that directly hosts an executable Node script and the skill document explicitly instructs users to download and run that script (including guidance to set a private key), which matches high-risk indicators for distributing malicious code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill (and its call.mjs runner) fetch runtime JSON and executable code from https://fittings.sh (e.g., https://fittings.sh/skill/call.mjs and https://fittings.sh/v1/weather/nws-point-forecast), which are retrieved during execution and directly influence the client's behavior and can be executed, so they meet the flagged criteria.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly supports a paid API flow that requires the client to sign an authorization with an on-chain wallet (USDC on Base). It instructs setting a private key (FITTINGS_PRIVATE_KEY), running call.mjs to sign/authorize payments, mentions a facilitator settles gas, and references npm packages for EVM signing. This is a specific crypto payment integration (wallet signing and spending), i.e., direct financial execution capability.