goldrush-cli

SUSPICIOUS: the skill's purpose and core capabilities are coherent for a blockchain CLI/MCP integration, and the installer is same-org via npm rather than an obviously rogue source. However, it still executes unpinned third-party code with `npx`, installs MCP integration, and documented MCP traffic may traverse a Vercel-hosted intermediary, so the trust and data-flow footprint is broader than a simple direct API client.