orcid-researcher-profile

SUSPICIOUS. The skill’s research purpose is coherent, but its footprint is broader than necessary: it uses a third-party paid gateway, asks the agent to fetch and run an unpinned remote script, and can sign spending with a plaintext wallet key. This looks more like a risky metered integration than confirmed malware, but the install and credential/payment model are not proportionate to a basic ORCID profile lookup.