opentrade-dex-swap

SUSPICIOUS overall. The skill's trading capabilities align with its stated purpose, but it relies on a raw GitHub curl|sh installer and an external CLI that receives API credentials and prepares live crypto trades. Same-org releases and checksum verification make this more coherent than overt malware, yet the combination of remote install, credential forwarding, and real-world financial actions creates meaningful security risk.