text-sentiment

SUSPICIOUS. The skill’s purpose and API usage are coherent, but its trust model is weak: it instructs the agent to download an unpinned remote helper script and then pass a wallet private key to that code for payment signing. Because the executable helper is not verifiably released via an official registry or signed artifact, the main risk is credential forwarding and supply-chain compromise rather than confirmed malware.