USDD / JUST Protocol

SUSPICIOUS. The skill's capabilities mostly match its stated crypto purpose, and data appears to flow directly to TRON/USDD contracts rather than an unrelated proxy. However, it enables autonomous financial actions with a private key and the exact dependency set/publisher-package relationship is not verifiable from the provided skill alone, so risk is above benign even without signs of credential exfiltration or malware.

The fragment appears to be a legitimate TRON token-swap CLI, not malware. It performs expected balance, allowance, approval, and PSM swap operations. The unlimited approvals create a meaningful authorization risk, and the buy path may contain a unit/decimals bug because it submits gemAmtRaw calculated with USDT decimals while checking USDD amounts with USDD decimals. Review ./utils and contract/token configuration before use, and prefer exact or limited approvals where supported.