phantom-wallet-mcp

SUSPICIOUS. The skill is purpose-aligned and appears to use Phantom-operated distribution and APIs, so it is not strong evidence of malware. However, it executes an unpinned npm package and gives an AI agent the ability to initiate high-impact wallet actions, making the overall security risk high despite largely coherent design.