bitflow-limit-order

SUSPICIOUS/HIGH-RISK rather than confirmed malicious. The skill is internally aligned with its stated DeFi limit-order purpose and uses apparently official Bitflow API endpoints, but it enables autonomous on-chain trading with user funds, handles wallet secrets, and relies on third-party package code with only moderate supply-chain verifiability. Main concern is financial/autonomous-action risk, not overt credential theft or deceptive exfiltration.