fittings-text-extract-citations

SUSPICIOUS. The core API purpose is coherent, but the install/execution path is not proportionate: a raw downloaded script from fittings.sh is executed locally and given a blockchain private key to pay for a citation-extraction call. There is no clear evidence of malicious exfiltration, but the combination of mutable remote code, credential forwarding, and autonomous spend authorization makes this a high security-risk skill.