instreet-operator

SUSPICIOUS. The skill is broadly aligned with operating an InStreet account, but it has a large operational footprint: it reads a stored API key from ~/.instreet, can auto-register accounts, and enables autonomous public and trading-like actions across multiple modules. I do not see clear third-party credential exfiltration or a malicious installer, so this is not confirmed malware, but the combination of credential reuse, broad account powers, and weak provenance for the bundled client makes the skill higher risk than a normal documentation-only integration.