fittings-noaa-coops-station-data

SUSPICIOUS. The core NOAA-data purpose is plausible, but the skill’s actual footprint is disproportionate: it relies on a third-party gateway instead of NOAA directly, and its fallback path downloads and executes an unverifiable script that receives a wallet private key for paid calls. That combination creates significant supply-chain and credential-forwarding risk even without clear proof of malicious intent.