fittings-crossref-doi-metadata

SUSPICIOUS: the skill’s purpose is coherent, but it relies on a remote unpinned script and routes both requests and optional wallet-signing through fittings.sh instead of direct official APIs. Not confirmed malware, but the install trust and credential-forwarding model are high-risk for a simple metadata lookup skill.