aicoin-onchain

SUSPICIOUS: The skill is mostly coherent with its stated on-chain trading purpose and uses official OKX Web3 endpoints, but it enables high-impact financial actions and optionally accepts a private key for automated trading. Not confirmed malware, but it carries high operational risk and should only be used with explicit user approval and careful handling of secrets.

The fragment appears to implement an intentional OKX-based multi-chain swap CLI rather than malware. It does not directly exfiltrate private keys or execute arbitrary code. However, it is high-impact wallet code: it signs remote transaction payloads and broadcasts them, with insufficient local validation of transaction semantics. A compromised API or dependency could potentially move wallet funds or obtain token approvals. The embedded/configurable fee wallets and default 1% fee should be disclosed and reviewed. Use only with a restricted wallet and independently validate returned transactions before signing.