openfin-pons

SUSPICIOUS. The skill is largely coherent for a crypto token-launch workflow, but it enables irreversible financial transactions and depends on another skill plus third-party services (Pinata, Codex/Uniblock). No clear credential harvesting, covert behavior, or malicious installer is shown, so this is not malware; risk comes from autonomous high-impact blockchain actions and transitive trust.