fittings-semver-range-resolve

SUSPICIOUS. The core purpose is coherent, but the skill’s paid path materially expands trust: it downloads an unverified JS client from fittings.sh and then gives that script a wallet private key for off-chain payment signing. That combination is disproportionate for a semver helper and creates a high supply-chain and credential-forwarding risk, even though the service itself appears real and purpose-aligned. Free schema/quote usage is low risk; paid execution is high risk.