fittings-crypto-hash-digest

SUSPICIOUS: the skill’s network behavior matches its stated purpose, and the download source appears to be the publisher’s own domain, but the overall footprint is disproportionate for hashing because it requires downloading remote code and optionally exposing a crypto private key to make paid requests. This is more a financial/supply-chain risk than confirmed malware.