hodlmm-move-liquidity

SUSPICIOUS: the skill’s capabilities match its DeFi rebalancing purpose, and the dependency/API footprint appears mostly legitimate, but it is inherently high risk because it gives an AI agent autonomous authority to sign and broadcast mainnet liquidity-moving transactions using wallet credentials. This is not confirmed malware or clear credential theft, but it is a dangerous financial automation skill that should be treated as high security risk.

No clear malware or credential exfiltration is evident. This is a wallet-signing liquidity rebalancer, but its transactions have no post-conditions, and remote pool metadata contributes to signed transaction arguments. Review the router contract and API trust assumptions before use; protect the password and private key, and use caution with auto mode.