fittings-epa-carbon-estimate

SUSPICIOUS. The API purpose and endpoint are coherent, but the skill’s trust model is disproportionate: it tells the agent to download an unpinned remote helper and then pass a blockchain private key to it for signing. Data flow appears aligned to fittings.sh, yet the unverifiable executable plus credential forwarding creates a high supply-chain and wallet-compromise risk.