polyclaw

SUSPICIOUS: the skill is purpose-aligned and mainly uses legitimate services, but it grants an AI agent direct financial trading power, requires a raw private key, and may route exchange traffic through third-party proxies. This is not confirmed malware, but it is a high-risk trading skill with meaningful secret-handling and real-world action exposure.