cpsc-recall-check

SUSPICIOUS. The core lookup purpose is plausible, but the actual footprint is broader: it routes requests through a third-party gateway, asks the agent to download and run an external helper, and can use a plaintext wallet private key to authorize spending. Those behaviors are disproportionate for a recall-check skill and create supply-chain and credential-forwarding risk even though the documentation is transparent about them.