calc-evaluate

SUSPICIOUS: The stated purpose is coherent, but the skill’s actual footprint includes downloading an unpinned JS client from the service domain and passing a plaintext wallet private key into that code for signing. That combination creates a high supply-chain and credential-forwarding risk even without clear evidence of malicious intent.