epa-carbon-estimate

SUSPICIOUS. The skill’s core capability matches its stated purpose, but it combines a direct-download executable script with a plaintext wallet private key for paid requests. The data flow is coherent and same-origin with the publisher, so this is not confirmed malicious, but the install path and credential sensitivity make it a medium-high security risk for an AI agent skill.