zerion

SUSPICIOUS: the skill is internally coherent for a crypto-wallet/trading agent and uses mostly official Zerion infrastructure, so it is not confirmed malware. However, it grants an AI agent high-impact financial capabilities, handles very sensitive wallet credentials, and relies on an unpinned runtime CLI install, making the overall security risk high despite good purpose alignment.

This fragment appears to document Somnia Reactivity and demonstrate integration with the Zerion CLI. It does not show clear malware, credential theft, persistence, cryptomining, or data exfiltration. The principal security concern is the use of shell-interpolated `execSync` commands for automated financial actions. If interpolated values can be influenced by untrusted event or user data, command injection and unauthorized trades are possible. Use `execFile` or `spawn` with an argument array, strict validation, explicit authorization, and transaction/action allowlists. The assessment is limited to the supplied fragment.

No clear malicious behavior or intentional obfuscation is present. The document describes legitimate DeFi discovery and deposit automation, but it operates in a high-impact financial domain and trusts external API results and an unreviewed globally installed CLI. Require explicit user confirmation, validate vault contracts and route calldata, verify chain/token/spender/fee/slippage details, and review the provenance of `zerion-cli` before use. The fragment alone does not establish malware.

No direct malware or supply-chain payload is evident because the input is descriptive documentation rather than executable code. The workflow is nevertheless high risk: it grants a natural-language agent write access to a wallet and permits irreversible transfers, arbitrary calldata, leveraged trading, automated strategies, betting, and spending wallet funds on external services. It should be used only with strict limits, transaction simulation and confirmation, verified destinations and chains, isolated credentials, and a dedicated low-balance wallet.

No direct malware is present in this documentation-only fragment. However, it instructs users to install unverified global npm CLIs and execute commands that can initiate fiat payments and irreversible cryptocurrency transactions. Package authenticity, official ownership, version pinning, integrity hashes, wallet-address verification, and transaction previews should be established before use.