fittings-doc-url-metadata

SUSPICIOUS: the core metadata-fetching behavior is coherent and uses the stated official domain, but the skill relies on a raw downloaded helper script and can pass a blockchain private key into that script for paid calls. This is not clearly malicious, yet the install trust and credential-forwarding footprint are higher than a simple URL preview skill should ideally require.