basename-agent

SUSPICIOUS. The stated purpose matches the capabilities, but the skill enables autonomous onchain actions with real financial consequences and depends on an unseen local script path that receives a raw wallet private key. Install sources are mostly legitimate npm packages, so this is not confirmed malware, but the combination of credential sensitivity, autonomous transaction signing, and missing code makes the skill high risk.

No clear malicious behavior or explicit private-key exfiltration is present. However, auto-approval and auto-signing are enabled by default, allowing a connected dApp to request signatures and transactions without user confirmation. This is a significant wallet safety risk; interactive mode should be enabled and transaction/request validation strengthened.

This is a Basenames registration automation script, not clear evidence of intentional malware. However, it grants an unverified WalletConnect proposer broad signing and transaction authority and automatically executes requests with the local private-key wallet. A compromised or unexpected site/session could therefore induce arbitrary signatures or transactions and cause loss of funds. Do not run it with a valuable wallet unless requests and transaction details are strictly validated and confirmed.