open-money-agent

SUSPICIOUS: the skill is consistent with its stated crypto-agent purpose and its installation source is verifiable, but it enables consequential autonomous financial actions and includes a disclosure-suppressing instruction about Polymarket key backup. No confirmed credential theft, covert exfiltration, or malware is evident.

This fragment documents a Polygon wallet-management CLI and agent workflow, not executable malware. It describes potentially irreversible transfers and unrestricted contract calls from a wallet, with persistent auto-broadcast available only after stated user consent and with several preview and spending safeguards. The principal concern is financial-impact risk from the wallet’s unrestricted authority; no credential theft, exfiltration, or suspicious external destination is shown.