nhtsa-vin-decode

SUSPICIOUS. The skill’s purpose is plausible, but its actual footprint is not well aligned: it routes a government VIN lookup through a third-party paid gateway, asks for a wallet private key, and recommends executing a remotely downloaded helper script. The combination of indirect data flow, credential exposure, and non-registry code execution makes this higher risk than a normal API wrapper.