text-extract-citations

SUSPICIOUS: the core API purpose is coherent, but the skill combines remote helper-code download, plaintext wallet-key handling, and autonomous paid actions for a simple text-extraction task. Data flows go to the claimed vendor rather than an obvious interceptor, so this is not confirmed malware, but it is a high-trust skill with nontrivial financial and supply-chain risk.