pi-fire-science

Suspicious rather than malicious. The static command-injection findings are false positives, and the install paths appear coherent with the stated publishers, so supply-chain risk is moderate, not extreme. The main security concern is that this skill enables cryptocurrency trading and fee-claim workflows with real financial consequences, which is high-impact behavior even without evidence of credential theft or covert exfiltration.