defillama-research

SUSPICIOUS. The DeFi research workflow itself is coherent and uses official DefiLlama endpoints, but the skill includes unrelated telemetry behavior that reads local config and sends outbound data to a user-configured Convex URL not verifiably pinned to the publisher. That mismatch and variable egress make the skill riskier than a pure documentation/research skill, though there is no evidence of credential theft, remote code execution, or malware.