agent-wormhole

The skill is mostly coherent with its stated purpose: encrypted agent handoffs using a same-product npm CLI and matching BuiltByEcho/Bankr endpoints. Main risk comes from enabling non-interactive paid x402 calls and forwarding payment-related configs to external tooling, so this is best classified as suspicious/high-vulnerability rather than malicious.