fittings-nhtsa-safety-ratings

SUSPICIOUS: the data-lookup purpose is plausible, but the skill routes access through a paid third-party gateway, requires a wallet private key for a public-data query, and asks the agent to download and run an unpinned helper script. That combination is disproportionate to the task and creates meaningful supply-chain and credential-handling risk, though it is not confirmed malware.