ndc-package-lookup

SUSPICIOUS. The skill’s lookup purpose is legitimate, but its actual footprint is broader than necessary: it routes a public FDA data lookup through a paid third-party gateway, requires a sensitive wallet private key for real use, and recommends downloading executable client code from an unpinned same-origin URL. This is not confirmed malware, but it creates meaningful supply-chain and credential-forwarding risk that is disproportionate to a simple NDC directory query.