pp-yahoo-finance

SUSPICIOUS: the core finance-data purpose is coherent, but the skill expands into higher-trust areas than a simple Yahoo Finance wrapper: third-party CLI/MCP installs, browser-cookie session import, arbitrary webhook delivery, direct SQL access, and transitive MCP installation. Nothing here is confirmed malware, but the install provenance is not established in the supplied evidence and the outbound delivery features materially raise security risk.