taskmarket-delegate

SUSPICIOUS. The overall footprint mostly matches a TaskMarket delegation skill: it talks to first-party TaskMarket endpoints, uses proportionate credentials, and includes an authorization gate for paid actions. The main concerns are medium-risk real-world action capability and a notable mismatch between the skill’s claimed create/submit API flow and current official TaskMarket documentation, plus reliance on an unseen local script that handles the API key. This is not confirmed malware, but it is not fully trustworthy without reviewing scripts/taskmarket-delegate/scripts/taskmarket.js and validating the live API contract.