utilia-pdf-to-markdown

SUSPICIOUS: the skill’s document-conversion purpose is coherent, but its footprint is unusually sensitive because it requires a blockchain private key and runs an unpinned external CLI to sign payments and transmit document data. This looks more like a legitimate but high-trust paid integration than outright malware; risk comes from credential forwarding, external execution, and autonomous spend rather than clear deception.