x402-express-wrapper

SUSPICIOUS: The skill’s purpose and requested credentials are broadly coherent for a paywall middleware, and data appears intended for official Base RPC/on-chain settlement rather than an obvious exfiltration proxy. However, install trust is only medium: the documented package name is legacy, current upstream docs point to @x402/express, and the claimed M2MCent official publisher relationship is not clearly verifiable from the evidence. Because the wrapper receives a blockchain private key, this provenance ambiguity is proportionately concerning even without signs of confirmed malware.