fittings-fec-candidate-search

The skill’s stated purpose is coherent, but its execution model is high risk: it asks the agent to download an unpinned remote script and then supply a raw wallet private key to that script for payment signing. Because the code handling the key is not independently verifiable from the provided evidence, this is best classified as suspicious with elevated security risk rather than confirmed malware.