fittings-pkg-name-check

The skill’s stated purpose matches its API usage, but its trust model is weak: it instructs the agent to fetch and run an unpinned remote JS client and then optionally hand that client a wallet private key. Data flows are mostly coherent with the service, yet credential forwarding to unverifiable executable code makes this suspicious and high risk despite limited scope.