fittings-water-noaa-tides

The skill’s stated purpose matches its NOAA tide API behavior, but its trust model is disproportionate: it asks the agent to download and execute an unpinned remote script and optionally hand that script a blockchain private key. This is not confirmed malware, but it is a high-risk supply-chain and credential-forwarding design and should be treated as suspicious.