taskmarket

SUSPICIOUS. The marketplace, wallet, messaging, and email features are broadly aligned to the stated purpose and use mostly same-org endpoints plus an official npm package, so this is not confirmed malware. But the skill has a high operational risk footprint: it forces remote instruction refreshes and latest-package upgrades each session, instructs the agent to run server-provided pendingActions commands verbatim, and enables autonomous financial and communication actions. Those combined patterns make the skill too risky to treat as benign without strict human approval for each external action.