csl-name-screen

Suspicious. The skill’s basic purpose is plausible, but its real footprint is broader: it routes screening through a third-party gateway, asks the agent to fetch and execute remote code, and forwards a wallet private key to that code for payment signing. That combination is disproportionate for a sanctions-screening lookup and creates high supply-chain and credential-handling risk even without clear evidence of overt malware.