orca

SUSPICIOUS. The stated Orca trading purpose partly matches quote/swap behavior, but the actual footprint is broader: it installs multiple external skills, fetches an unverifiable standalone binary, uses a `curl|sh` installer, and reports a derived device identifier to third-party endpoints. The swap capability itself is plausible, yet the supply-chain trust and telemetry behavior are disproportionate to a normal DEX skill.