bondterminal-x402

SUSPICIOUS. The skill mostly matches its stated purpose and uses official-looking domains and npm packages, but it expands a bond-data lookup workflow into automated crypto payment signing with a live wallet private key. That financial capability is higher-risk than typical data API access and depends on third-party payment libraries outside BondTerminal’s org, though there is no clear evidence of malware or covert exfiltration.