water-usgs-streamflow

SUSPICIOUS. The stated purpose is plausible, and the USGS provenance claim for the underlying data is coherent, but the skill’s actual footprint is broader: it downloads and runs an unverifiable remote script and asks for a plaintext blockchain private key to use with that script. Because the paid flow depends on third-party code and gateway logic instead of directly querying the public USGS API, the install trust and credential-forwarding risks are disproportionate to a simple streamflow lookup.