citation-check

SUSPICIOUS: the skill’s research-reference purpose mostly matches its behavior, but it routes all lookups through fittings.sh instead of official registries and requires a raw wallet private key for payment. This is not confirmed malware, but the intermediary data flow and private-key handling create meaningful trust and credential risk.