pump-ai-agents

SUSPICIOUS. The skill’s general crypto/Pump SDK purpose is coherent, but it goes beyond passive agent guidance by having the agent install and run an unverified MCP server via unpinned `npx -y`. Because the external CLI provenance was not clearly verified and such tooling may receive wallet or RPC credentials and enable financial actions, the install-trust and scope risks are disproportionate to a documentation-style skill.