crypto-hash-digest

SUSPICIOUS. The stated purpose is coherent, but the footprint is disproportionate: a simple hash function is outsourced to a paid remote service, with optional curl-fetched helper code and wallet-key-based payment signing. This looks more like a monetized API/payment skill than a minimal digest utility, so the main risks are remote-code trust and autonomous spending rather than confirmed malware.