fittings-orangebook-therapeutic-equivalence

SUSPICIOUS. The core lookup purpose is plausible, but the skill’s actual footprint is broader than necessary: it routes medical lookups through a third-party gateway, fetches executable client code from a remote URL, and asks the agent to use a plaintext wallet private key for automated payment signing. This looks more like a paid API/payment wrapper than a simple FDA lookup skill, creating meaningful supply-chain and credential-forwarding risk even without clear evidence of malware.