top-rank-tokens-sniper

SUSPICIOUS. The skill’s capabilities largely match its stated trading purpose, and its installs appear same-org and partially verified, so this is not confirmed malware. However, it enables autonomous real-money trading, installs additional skills, and executes a downloaded installer script, making the overall security risk high and disproportionate for routine agent use.

No clear malware behavior is evident. This is a trading bot with legitimate but high-impact live wallet operations. The unauthenticated loopback dashboard can expose sensitive control actions to local browser-originated requests, and live signing trusts transaction data returned by the CLI. The supplied code is incomplete at the end.

No clear malware, credential theft, or unauthorized exfiltration is present. The code has a DOM XSS risk because API-provided data is inserted into `innerHTML` without escaping. Server-side controls for live trading and reset operations cannot be assessed from this file.