alva

This skill is purpose-aligned with a finance automation platform and uses mostly official Alva/npm distribution paths, so it does not look malicious. However, it grants a very broad operational footprint—external content ingestion, secrets use, code execution, publishing, alerts, and even trading—so the overall security risk is medium-high, driven mainly by autonomy and indirect prompt-injection exposure rather than malware signals.