alphagbm-options-strategy

SUSPICIOUS: The skill’s core capability matches its stated purpose, and it does not install tools or read unrelated files. However, credential and data flow go to a Zeabur-hosted domain instead of a clearly documented AlphaGBM-owned API endpoint, and the base URL can be overridden to arbitrary hosts. That mismatch makes the trust boundary weaker than expected for a financial API skill.