wallet-tracker-mcap

SUSPICIOUS. The skill’s capabilities align with its stated purpose, and the dependency appears to be an official same-org CLI rather than an unrelated downloader. However, the skill empowers autonomous cryptocurrency trading and transaction signing with real financial consequences after a session-level confirmation, making the overall security risk high even without clear malware or credential theft behavior.

No clear evidence of malware or covert data theft is present. This is an automated copy-trading application with substantial intentional financial authority in live mode. Review the onchainos transaction-generation and signing behavior carefully: the fallback signs returned unsigned transaction data without local transaction-content validation. The unauthenticated dashboard is limited to loopback but may be accessible to local processes or users.