fmt-xml-to-json

SUSPICIOUS: the core API purpose and endpoint are internally consistent, but the skill couples remote script download with optional wallet-key-based payment signing. This is not clearly malicious, yet the install and payment trust model is heavier than a simple format-conversion skill and creates medium security risk.