lobstercash

SUSPICIOUS. The skill’s capabilities broadly match its stated purpose, and the main CLI install path appears same-org and legitimate. However, the purpose itself is high risk: it enables autonomous spending, crypto transfers, browser-driven checkout, and temporary payment credential handling. Guardrails are present, but this is still a high-security-risk skill because it can cause irreversible real-world financial actions and processes untrusted web content while holding payment authority.

The fragment is purchase-command documentation rather than malicious code. It describes legitimate browser checkout automation but carries meaningful privacy and financial-authorization risk because user data and card identifiers flow into merchant checkout and orders may be placed automatically without final confirmation. No direct malware indicators are present.

This is transaction-operation documentation, not malware or executable package code. It describes a high-impact capability to sign and submit arbitrary blockchain transactions, creating a potential financial risk when untrusted serialized transactions or calls are approved. No malicious behavior is evident in the provided text; assessment of the underlying CLI would require its implementation.