openfinclaw-ai-quant-research

Mostly coherent quant-research skill with expected API-key use and MCP integration, but medium risk due to npx @latest remote execution, automatic credential/config persistence, and imperfect provenance linkage between the npm package and a clearly same-org source repository. No strong evidence of malware or credential theft, but trust and autonomy concerns make it suspicious rather than fully benign.