pump-mcp-server

SUSPICIOUS: the visible functionality is a crypto wallet skill with legitimate-looking local key operations, but the skill’s stated footprint is internally inconsistent and the publisher/homepage provenance is not cleanly verified. No direct malware, exfiltration endpoint, or dangerous installer is shown, yet the combination of crypto signing capability plus description/provenance mismatch makes this higher-risk than a normal documentation-only skill.