fittings-pep-wikidata-screen

The skill’s purpose and API behavior are mostly coherent, but the trust model is weaker than a typical reference skill: it fetches an unverified helper script over HTTPS and pairs that script with a plaintext blockchain private key for paid calls. This looks more suspicious than malicious; the main risks are supply-chain exposure and credential misuse, not clear evidence of exfiltration.