fx-convert

SUSPICIOUS: the core FX-conversion purpose is legitimate, but the skill asks the agent to fetch and run an unpinned remote JS client and optionally hand it a wallet private key for payment signing. That combination makes the footprint riskier than the simple stated purpose, with the main issue being supply-chain and credential-forwarding trust rather than confirmed malware.