corbits-marketplace

SUSPICIOUS. The skill’s purpose is plausible, but its footprint is disproportionate: it installs from a public third-party skill registry, asks the user to export and paste a wallet private key into the skill, stores that key locally, and enables autonomous financial actions and proxy-routed paid API calls. This is not confirmed malware, but it is high risk and should not be treated as a low-trust convenience integration.