fittings-ghsa-advisory

SUSPICIOUS: the skill’s purpose is coherent, but its footprint is riskier than necessary because it uses a third-party paid gateway, suggests unpinned remote script download, and asks the agent to hold and use a plaintext wallet private key for spending. Not confirmed malware, but medium-high security risk.