t2000-engine

SUSPICIOUS: The skill's capabilities broadly match its stated purpose as a financial agent engine, and the npm-scoped dependency appears proportionate. However, it enables real-world financial actions, forwards credentials to package/provider code, and processes external MCP content with tool access, creating medium security risk even without clear signs of outright malware.