hodlmm-signal-allocator

SUSPICIOUS/HIGH-RISK as an AI agent skill: the stated purpose matches the capabilities, but it enables on-chain financial execution using wallet signing, external signal feeds, and an unpinned third-party SDK. This is not confirmed malware or obvious credential theft, yet it is a high-security-risk skill because it can autonomously affect real funds and should require strict user approval and dependency verification.

No clear malicious behavior or explicit credential exfiltration is evident. The code is a legitimate-looking crypto swap CLI, but live transactions can spend wallet funds, and the lack of a check matching the balance-checked wallet to the signing wallet is a material safety risk. Review SDK behavior and wallet configuration before live use.