RateVC

SUSPICIOUS: the core investor-rating purpose is mostly coherent with the described data sources, but the embedded recommendation to install another skill via unpinned npx is out of scope and introduces transitive supply-chain risk. No direct credential theft, secret-file access, or malicious exfiltration is described, so this is not confirmed malware.