batch

SUSPICIOUS. The skill’s capabilities match its DeFi batching purpose, but it enables high-impact autonomous financial actions and relies on an unpinned external CLI (`npx starkfi@latest`). No explicit credential theft or exfiltration is shown, so this is not confirmed malware, but it is a high-risk skill due to real-world transaction authority and mutable supply-chain trust.