fittings-kev-status

SUSPICIOUS. The stated purpose is coherent, but the skill's paid path relies on downloading and executing an unpinned remote script from fittings.sh, then giving it a plaintext wallet private key for payment authorization. That is disproportionate for a simple KEV lookup and creates significant supply-chain and credential-forwarding risk, even though the domain and API purpose appear consistent.