kamino-lend-plugin

SUSPICIOUS. The skill's lending/trading capabilities match its stated purpose and its confirmation gates are unusually strong, but its install footprint is broader than necessary: it downloads and runs a raw installer, installs a standalone release binary plus launcher, and chains into additional skill installations. Data flows appear aligned with OKX/Kamino usage rather than obvious credential theft, so this is not confirmed malware, but it is a high-risk financial skill with notable supply-chain and transitive-trust concerns.

The fragment appears to implement a lending repayment workflow, not malware. It has a significant consent and preview-mode issue: the automatic Jupiter swap may be submitted before the --confirm guard, causing a real on-chain financial transaction during an apparent preview. Review and move the confirmation gate ahead of any swap side effect, or require separate explicit authorization for the swap.