pump-fun-plugin

SUSPICIOUS: the trading purpose matches the blockchain capabilities, and the confirmation protocol is unusually safety-conscious, but the skill still performs autonomous financial actions and relies on a multi-step install chain that downloads a launcher and an unverified plugin binary plus transitive skills. The main concern is supply-chain and trust expansion, not clear credential theft or covert exfiltration.