onchain-pay-open-api

SUSPICIOUS: The skill’s core capability matches its stated Binance Onchain-Pay purpose, and the installer appears publisher-consistent. However, it handles high-value financial actions and forwards credentials/signatures to a configurable endpoint, with examples using a non-obviously Binance domain (`api.commonservice.io`). That makes the trust and data-flow model riskier than a typical API guide, though not clearly malicious.

The code appears to be a readable API signing client rather than malware. It intentionally transmits credentials and signed request data to a caller-specified endpoint, so its safety depends on BASE_URL being trusted. Lack of destination validation creates a credential-disclosure risk if the script is invoked with an attacker-controlled URL. The fallback can also duplicate POST operations. Use HTTPS, validate or allowlist the endpoint, avoid passing secrets on the command line, and handle the response without replaying the request.