wallet-cli

No malicious behavior is demonstrated in the supplied documentation, and no executable implementation was provided. The curl-to-shell installer and unverified `npx skills add` workflow present meaningful supply-chain risk because remote content is executed or installed without checksum, signature, or commit pinning. The wallet context increases the potential impact, so the referenced package and scripts should be independently inspected and verified before use.