polyhub_discover

SUSPICIOUS. The core read-only discover functionality is broadly consistent with the stated purpose, but the data flow goes to a test/dev-style hubble-rpc hostname that is not clearly established here as the official public API, and the skill nudges users into a separate copy-trading skill with real-world financial impact. This is not confirmed malware, but the endpoint provenance and cross-skill handoff make the skill riskier than a normal public-data lookup skill.