fittings-qr-generate

SUSPICIOUS. The core QR capability matches the stated purpose and the network endpoints are same-domain, but the skill mixes a mutable remote helper download with plaintext private-key usage and autonomous off-chain payment signing. This looks coherent rather than overtly malicious, yet it carries meaningful supply-chain and financial-credential risk disproportionate to a simple QR utility.