crypto-com-exchange

The skill is coherent with its stated purpose and the cdcx tooling appears to be same-org and legitimate, so this is not confirmed malware. However, it is a high-risk financial-action skill: it can execute trades and withdrawals, depends on an external CLI/plugin with unpinned install paths, and therefore should be classified as vulnerable/high risk rather than benign.

No direct malware is present in the supplied documentation. The installation instructions introduce supply-chain risk by executing mutable latest package versions and by piping a GitHub-hosted shell script directly to sh. Users should prefer pinned versions, verify package provenance and checksums or signatures, and inspect install scripts before execution.