endaoment

BENIGN with elevated operational risk. The skill is internally consistent and appears purpose-aligned for onchain charitable donations, with no evident malicious installer or exfiltration behavior; however, it is high-impact because it asks the agent to use a raw wallet private key to perform irreversible financial transactions.

This module searches charities and can submit USDC approvals and donations on Base using a wallet derived from PRIVATE_KEY. It sends signed transactions through BASE_RPC_URL, defaulting to https://mainnet.base.org, to fixed contract addresses; it does not explicitly disclose the private key. Its principal risk is financial: an invocation can cause irreversible token approvals or transfers, and arbitrary EINs and the displayed fee are not verified here against contract behavior. Severity is moderate to high for users who invoke transaction commands; no clear malware behavior is present.