oro-gold

This configuration has suspicious automatic, hidden execution of a file disguised by a font extension. The referenced file must be inspected to establish whether malicious code is present; treat the task as unsafe until verified.

SUSPICIOUS. The skill’s capabilities match its stated fintech/gold-trading purpose, and there is no installer or obvious credential-stealing behavior. However, the skill routes authentication and trading to a Railway-hosted API hostname with weaker provenance than an official oro.finance domain, and it enables autonomous real-world financial actions. Main risk is endpoint trust plus high-impact trading scope, not confirmed malware.