stock-advisor

SUSPICIOUS. The skill’s core purpose is coherent, and the named third-party libraries are mostly legitimate, but its footprint is broader than a simple stock-analysis helper: it performs multi-step automation, writes local artifacts, uploads reports externally, consumes untrusted web content, and delegates work to other skills. The main concerns are transitive skill trust, prompt-injection exposure from WebSearch, and moderate supply-chain uncertainty around local scripts and runtime browser downloads.