rain-trade

SUSPICIOUS: the capability matches the stated purpose, but the skill is high risk because it enables autonomous on-chain trading with real financial consequences and relies on an npm SDK whose official provenance was not verified from first-party protocol documentation. No clear credential theft or covert exfiltration is shown, so this is better classified as vulnerable/high-risk rather than confirmed malware.