robo-miner-agent

SUSPICIOUS: the skill’s footprint mostly matches its stated purpose, but that purpose itself is high-risk because it gives an AI agent autonomous wallet-driven blockchain and token redemption capabilities. The install path also relies on transitive GitHub skill loading and external CLI tooling, which raises supply-chain and credential-handling risk even without clear evidence of malware or hidden exfiltration.

No clear supply-chain malware behavior is evident in this Bash fragment (no key theft, no exfiltration, no backdoor/persistence beyond a coproc session, no system damage). The primary security concern is the use of `eval` to start `coproc` with interpolated variables (especially `VARA_WALLET_BIN`), which could enable shell command injection if environment/config values are attacker-controlled. Otherwise, the script validates action methods/JSON arguments and delegates signed/network actions to `vara-wallet`.