fittings-airport-nearby

The skill’s stated purpose matches its API behavior, and network calls go to the declared service. However, it tells the agent to download and run an unpinned remote executable script from fittings.sh, then provide a wallet private key to it for payment authorization. That creates a high supply-chain and credential-forwarding risk even without clear evidence of malicious intent.