fittings-npi-provider-lookup

SUSPICIOUS: the skill's healthcare lookup purpose is plausible, but its actual footprint is larger than expected because it routes requests through fittings.sh, downloads and executes a remote script, and may use a wallet private key to authorize spending. The behavior is disclosed rather than hidden, so this is not confirmed malware, but it carries medium-high supply-chain, credential, and financial-action risk.