haedal-farming

SUSPICIOUS. The core behavior matches a farming skill, but it routes transaction-building data through a project-hosted intermediary API with limited public verification of the exact endpoint, and it enables financial actions. No malware indicators or malicious install chain were found, but the data flow and permissions are broader/higher-risk than necessary for a simple transaction helper.