collectorcrypt

SUSPICIOUS. The skill’s network endpoints largely match its stated CollectorCrypt purpose, and there is no obvious credential exfiltration or malicious installer. However, it grants an AI agent high-impact real-world capabilities—financial NFT trading, pack purchases, token broadcasts, and physical shipment creation—and includes a notable documentation conflict about authentication. High security risk comes from autonomous transaction/shipping scope, not confirmed malware.