hub-swap-planner

SUSPICIOUS. The core behavior mostly matches the stated purpose of planning PancakeSwap Hub swaps, and there is no malware-level installer, obfuscation, or credential theft pattern. However, it forwards a sensitive API token to a backend endpoint that is only partially publicly verifiable, sends telemetry to pancakeswap.ai at initialization, relies on mutable third-party/raw content for some discovery, and can autonomously open wallet handoff links. Those combined signals make it higher risk than a pure documentation skill, but still not fundamentally incompatible with its stated purpose.