fittings-usda-food-search

SUSPICIOUS. The stated purpose is coherent, but the trust model is not proportionate: a USDA lookup skill asks the agent to download and execute an unverifiable remote script, then expose a wallet private key to that script for payment signing. No direct malicious behavior is proven, but the install path and credential forwarding make this high risk.