pkg-normalize-manifest

SUSPICIOUS. The skill's core function is plausible, but its footprint is disproportionate: a package.json normalizer depends on a remote paid gateway, optional downloaded helper code, and potentially a blockchain private key. Data flows are disclosed rather than hidden, so this is not confirmed malware, but the install trust and credential scope make it a medium-high risk skill.