blofin-portfolio-analyst

SUSPICIOUS: The stated purpose is coherent with fetching BloFin balances, positions, fills, and orders, and the intended network destination appears to be official BloFin infrastructure. However, the required credentials would likely be forwarded to an external MCP tool whose official feature set includes trading and fund-transfer actions beyond portfolio analysis, making the effective capability footprint broader than the skill claims. No direct exfiltration or overtly malicious behavior is evident, so this is not malware, but it carries medium risk due to credential forwarding and scope mismatch.