pep-wikidata-screen

SUSPICIOUS: the skill’s PEP-screening purpose is coherent with the API it calls, but its trust model is not proportionate. The main risk is the same-domain yet unverifiable call.mjs download-and-execute path, combined with forwarding a plaintext private key into that script for payment signing. This is a high security-risk skill with strong supply-chain and credential-forwarding concerns, but not confirmed malware from the available evidence.