cve-lookup

SUSPICIOUS. The stated purpose is simple CVE lookup, but the skill adds a remote download-and-execute step, routes public-data requests through a third-party paid gateway, and asks the agent to expose a plaintext wallet private key to downloaded code. Those behaviors are disproportionate to CVE retrieval and materially increase supply-chain, credential, and financial risk.