fittings-gov-federal-spending

SUSPICIOUS: the skill’s purpose is coherent, but its trust model is weak. It downloads mutable same-origin code and then forwards a wallet private key to that code, while routing requests through a third-party payment gateway instead of the official USAspending.gov API. This is not confirmed malware, but it is a high-risk supply-chain and credential-handling pattern.