pump-sdk-core

SUSPICIOUS: The skill’s capabilities mostly fit its stated purpose as a Solana SDK guide, and its declared scope is relatively narrow. However, provenance is inconsistent: the claimed `8bitsats` repo/package could not be verified against the more clearly documented official `pump-fun` SDK source, creating medium supply-chain trust concerns. Separate from provenance, the skill facilitates cryptocurrency transaction construction with real-world financial impact, which raises overall risk even without clear evidence of malware or credential theft.