fittings-nws-active-alerts

The skill's weather-alert purpose is coherent, but its footprint is broader than necessary because it routes calls through a paid third-party gateway, uses a downloadable helper script, and can spend funds via a blockchain private key. This looks more suspicious than malicious: the main risks are supply-chain trust in call.mjs and credential/payment exposure to non-official infrastructure.