web-lookup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The bit.ly shortened link is suspicious because URL shorteners obscure the final destination and are a common vector for hiding malicious downloads; the other URLs point to the documented fittings.sh gateway and example.com, which are not suspicious in this context.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow scripts/call.mjs ingests outsider-provided text/URLs via --search and paid calls like doc.url-to-markdown/url.expand, which then fetch and read HTML/content from the (outsider-influenced) network pages at execution time.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The client explicitly fetches runtime service metadata and payment terms from https://fittings.sh (e.g. catalog endpoints and /skill/call.mjs.sha256), and those responses are used to build requests, enforce schemas and drive the payment handshake, so the remote content directly controls runtime behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly requires and instructs using a spending wallet private key (export FITTINGS_PRIVATE_KEY=0x...) to pay per-request charges in USDC on Base, describes off-chain signature to authorize USDC transfers, and explains the facilitator will submit the transaction and cover gas. That is a specific crypto payment/transaction capability enabling the agent to execute financial transfers.