byted-market-insight-agent

SUSPICIOUS：用途与市场洞察基本一致，官方 SDK 安装路径也较可信；但该 skill 默认偏好未明确归属的 Gateway、会扫描用户 shell 配置文件并持久化凭证，数据流与权限范围偏宽。未见明确恶意代码或执行型载荷，但整体应视为中等风险。

No clear malicious payload or direct exfiltration is present in the supplied fragment. The code performs legitimate provider and credential management, but it has meaningful security and supply-chain risks: it reads sensitive credentials from shell files, stores them plaintext, and automatically runs pip to install an unpinned SDK version. Network behavior of delegated provider modules is outside the supplied code and requires separate review.