usda-food-nutrients

SUSPICIOUS. The skill’s core function is coherent, but its footprint is broader than a nutrition lookup: it downloads a remote helper script, routes requests through a third-party gateway, and can use a plaintext blockchain private key for automated payment. This looks more like a paid proxy/payment client than a simple USDA data skill, creating medium security risk without clear evidence of outright malware.