npi-provider-lookup

SUSPICIOUS: the lookup purpose is coherent, but the skill adds medium-high trust risk by routing calls through fittings.sh and instructing the agent to download and run a remote helper script that handles a plaintext wallet private key. This is not confirmed malware, but the install path and credential exposure are disproportionate to a basic NPI lookup.