hts-lookup

SUSPICIOUS. The stated purpose is plausible, but the skill depends on an unverifiable remote client from `fittings.sh`, then invites the agent to use a wallet private key to authorize paid requests through that same third-party gateway instead of the official USITC API. The capability is not fully proportionate to a tariff lookup skill, and the credential-forwarding/install chain creates high security risk even without proof of overt malware.