fittings-cve-search

SUSPICIOUS: the stated purpose is plausible, but the skill’s real footprint is broader than a simple NVD search helper. It routes requests through a third-party gateway, asks the agent to download and execute remote code, and can use a plaintext wallet private key to authorize spending. The behavior is disclosed and partially scoped with caps/throwaway-wallet guidance, so this is not confirmed malware, but it is a materially risky design for a search skill.