pay-with-any-token

BENIGN but high-risk. The skill’s capabilities match its stated crypto-payment purpose and route data to official Tempo/Uniswap services, but it installs software via download-and-execute scripts and enables real financial transactions with API keys and signing credentials. The main concern is supply-chain/install trust and transaction impact, not covert exfiltration or confirmed malware.

This is payment infrastructure rather than apparent malware. It performs a legitimate x402/EIP-3009 payment flow, but signing the authorization is a high-impact operation. The missing enforced confirmation and reliance on externally supplied recipient, asset, amount, domain, and resource values create a significant financial-security risk if the surrounding integration does not validate them and obtain explicit user approval. No evidence of credential theft, persistence, obfuscation, cryptomining, or unrelated exfiltration appears in this fragment.

The fragment appears to implement a legitimate automated crypto swap and bridge workflow, with no clear malicious payload or covert exfiltration. It presents significant security risk because remote API-provided calldata is executed with a wallet, credentials are supplied to cast, and the bridge spender can receive an unlimited token allowance. The code should enforce real interactive confirmations and independently validate chain, token, recipient, contract addresses, calldata, value, and exact approval amounts before signing.