allium-x402

SUSPICIOUS: the overall purpose is coherent for a blockchain data skill, and the domains appear to belong to Allium, so this is not clearly malicious. However, the skill relies on unpinned remote execution and mutable remote instruction fetches, and the installer is downgraded to HTTP despite official HTTPS documentation. Because the installed CLI may receive auth or payment context, the install path creates meaningful supply-chain risk disproportionate to a simple data-query skill.