pancakeswap-clmm-plugin

SUSPICIOUS. The stated purpose matches the blockchain farming capabilities, and data flows mostly align with PancakeSwap/onchain usage. However, the skill has a large install footprint: it installs transitive skills, fetches scripts from GitHub raw, and downloads a compiled plugin binary plus launcher before use. Because the binary is an external executable rather than a standard registry package, this creates mandatory high supply-chain risk even with same-org provenance and checksum verification. The skill also enables real financial actions on-chain, so it should only be used with explicit per-action user approval.