walletconnect-agent

SUSPICIOUS. The skill is purpose-aligned and its install path is largely legitimate, but its purpose itself is high risk: it gives an AI agent autonomous control over a wallet private key and the ability to sign transactions, swap tokens, mint NFTs, vote, and register domains without mandatory human approval. Data flows appear direct to WalletConnect/RPC infrastructure rather than an obvious credential-harvesting proxy, so this is not confirmed malware, but it is a dangerous capability set for an agent skill.

No clear malicious behavior or explicit private-key exfiltration is present. However, auto-approval and auto-signing are enabled by default, allowing a connected dApp to request signatures and transactions without user confirmation. This is a significant wallet safety risk; interactive mode should be enabled and transaction/request validation strengthened.

This is a Basenames registration automation script, not clear evidence of intentional malware. However, it grants an unverified WalletConnect proposer broad signing and transaction authority and automatically executes requests with the local private-key wallet. A compromised or unexpected site/session could therefore induce arbitrary signatures or transactions and cause loss of funds. Do not run it with a valuable wallet unless requests and transaction details are strictly validated and confirmed.