midnightskill

No clear evidence of intentionally malicious behavior (e.g., backdoor or credential theft) is present in this module. However, the code has a significant DOM XSS risk: it fetches untrusted markdown content (from static files or an API), converts it to HTML with marked, and inserts it into content.innerHTML without explicit sanitization or configuration to prevent unsafe HTML. Additionally, marked/highlight.js are loaded from CDNs without SRI, increasing runtime integrity exposure.

SUSPICIOUS. The skill is broadly coherent with its stated purpose as a full Midnight DApp generator, and its network endpoints appear proportionate to that purpose. However, it combines a remote curl|sh installer, wallet seed handling, Docker image execution, and autonomous blockchain transaction capability, which creates meaningful security risk even without clear malicious exfiltration.