nookplot

SUSPICIOUS: the skill is broadly aligned with its stated purpose, and the install sources appear coherent with the Nookplot publisher, so this is not confirmed malware. However, it enables autonomous on-chain and public-facing actions, uses sensitive wallet/API credentials, processes untrusted network events through an LLM, and supports transitive skill installation—together making it a high-risk agent capability set that should only be used with strong user approval and isolation.