solana-connect

SUSPICIOUS: the skill’s Solana libraries match its stated blockchain purpose, and installs use normal npm sources, so this is not clearly malicious. But it enables autonomous crypto transfers, permits confirmation bypass, and contradicts its own key-protection claim by showing privateKey passed to sendSol(); combined with unpinned crypto dependencies and recent Solana SDK supply-chain history, this is a high-security-risk financial skill.