cobo-agentic-wallet-sandbox

High-risk but purpose-consistent crypto wallet skill. Its capabilities, credentials, and official Cobo API flows fit the stated Cobo wallet purpose, so this is not confirmed malware; however it enables autonomous financial actions, handles wallet API credentials, and recommends transitive skill installation, making it a vulnerable/high-risk skill rather than benign.

The fragment appears to be a legitimate CLI installer with normal download, caching, symlink, and PATH setup behavior. The primary supply-chain concern is that the cobo-tss-node archive lacks visible checksum or signature verification, allowing a compromised download source to install an executable and configuration. The caw verification is stronger but relies on a checksum fetched from the same base URL. No direct malware behavior is evident in the shown code; review the omitted helper definitions, default URLs, extraction implementation, and release-signing process before trusting the installer.