doc-url-metadata

SUSPICIOUS. The skill’s stated purpose is coherent, and its endpoint/protocol claims align with public x402 documentation, but it asks the agent to download and run a remote helper script and potentially hand that script a private key. That makes the install and credential trust footprint larger than expected for simple URL metadata retrieval. No clear evidence of malware or hidden exfiltration is present, but the combination of remote code execution plus wallet-key use makes this a medium-high security risk.