crossref-doi-metadata

SUSPICIOUS: the skill’s purpose is plausible, but its actual footprint is broader than a normal Crossref lookup. It routes requests through a third-party gateway, asks for a wallet private key, supports autonomous paid calls, and relies on an unpinned downloaded helper script. These are coherent with a paid gateway product, not with direct Crossref usage, so this is not confirmed malware but it carries meaningful supply-chain, credential, and financial-action risk.