ghsa-advisory

SUSPICIOUS: the stated purpose is legitimate, but the skill’s footprint is broader than necessary because a vulnerability lookup is coupled to downloading and executing an unverifiable helper script and optionally forwarding a wallet private key to it. The main issue is install/runtime trust and credential forwarding to opaque third-party code, not confirmed malicious intent.