iFinD-Finance-Data

SUSPICIOUS. The skill’s purpose, credential scope, and network destination are mostly consistent with a legitimate iFinD data client, and there is no hidden installer or unrelated exfiltration path. However, disabling TLS verification is a serious security flaw because it exposes the locally stored auth token and all API traffic to interception, pushing the overall risk to medium/high despite otherwise coherent functionality.

The code is a straightforward MCP API client and contains no clear malicious behavior or intentional data exfiltration beyond sending its configured authentication token to the explicitly hardcoded service. However, setting `verify=False` on all HTTPS requests is a significant security flaw because it allows man-in-the-middle attacks and token disclosure. Certificate verification should be enabled, and the token should be handled securely.