spatial-point-in-polygon

SUSPICIOUS. The core API purpose is coherent, but the skill’s footprint is heavier than necessary: it uses a remotely fetched helper script, supports transitive skill installation, and requires a plaintext blockchain private key for payment signing. Data flows stay on the same service domain, so this is not confirmed malware, but the credential-forwarding and supply-chain risks are disproportionate for a simple point-in-polygon skill.