fittings-web

SUSPICIOUS: the skill’s capabilities broadly match its stated purpose, but it routes lookups through a third-party gateway, introduces transitive install trust, and requires a wallet private key for paid execution. These are proportionate to the service model, so this is not confirmed malware, but it carries meaningful supply-chain, credential-handling, and third-party data-flow risk.