bounty-scanner

SUSPICIOUS. The skill’s capabilities broadly match its stated bounty-board purpose, but trust is weakened by routing sensitive claim/signature traffic to a lightly documented third-party API domain and by allowing endpoint override via BOUNTY_API_URL. Bun is an official same-org runtime dependency, so install risk is moderate rather than extreme. Main concern is data-flow integrity and autonomous real-world action: the skill can help initiate and submit signed bounty claims to a remote service whose provenance is only partially verifiable.