fittings-lang-bcp47

SUSPICIOUS. The API purpose is coherent, but the execution path relies on downloading and running an unpinned remote script, then optionally handing it a wallet private key. That combination creates a high supply-chain and credential-forwarding risk disproportionate to a simple validation task, even though the domain and endpoint appear consistent with the publisher.