pkg-name-check

SUSPICIOUS. The stated purpose is narrow and plausible, but the skill relies on downloading and executing an unverifiable script from fittings.sh and optionally forwarding a blockchain private key to that script. That combination is disproportionate for package-name validation and creates a high supply-chain and credential-handling risk, even without proof of malicious intent.