lulo

SUSPICIOUS: the core Lulo API documentation is mostly coherent and routes data to official Lulo endpoints, but the skill also facilitates live financial transactions and includes an unrelated third-party SolanaAgentKit example that receives private key/OpenAI credentials. That extra credential-forwarding scope is not well-aligned with a simple Lulo integration guide and materially increases risk.

No clear evidence of embedded malware or intentional obfuscation in this module. However, the module presents a significant supply-chain/behavioral risk: it signs and broadcasts server-generated Solana transactions provided by a remote API without local validation that they match the caller’s requested mint/amount/depositType/withdrawType or expected on-chain instructions. If the upstream API response is malicious/compromised or the transport is manipulated, this client can unintentionally authorize unintended transfers using the user’s wallet. Additional secondary risks include unvalidated filePath handling in fromKeypairFile() and potential leakage of API error payloads through thrown exceptions.