skopos

SUSPICIOUS. The skill is largely coherent with its stated crypto-copilot purpose and uses same-domain APIs plus an npm-distributed MCP package documented by the product, so there is no clear evidence of credential theft or hidden exfiltration. However, it facilitates autonomous crypto-related actions, forwards sensitive financial prompts/wallet data to an external service, and includes an external MCP install path; these are proportionate to purpose but still high-impact, so the overall security risk is medium rather than benign.