weather-live

SUSPICIOUS. The skill's stated purpose is coherent, but its actual trust model is heavier than expected: live public data is mediated through fittings.sh rather than official APIs, and paid use requires a raw spending-wallet private key. No explicit malicious behavior is shown in the text, but the combination of third-party data brokerage, credentialed payment flow, and unseen client code creates meaningful security and credential-handling risk.