hunch-bazaar

SUSPICIOUS. The skill’s stated purpose matches prediction-market actions, and it openly discloses centralized settlement risk, but the install path relies on an external personal GitHub repo through a cross-repo trust chain rather than a strongly verified same-org distribution channel. No direct credential theft or exfiltration is shown, but the installation trust and real-money action surface make the skill medium risk.