stocks-portfolio

SUSPICIOUS. The purpose is coherent with the capabilities: scraping brokerage/Carta positions and updating a portfolio sheet matches the skill’s stated goal, and the Google Sheets data flow via gws is largely legitimate. The main issue is proportionality and execution trust: this skill handles very sensitive financial account data through browser automation, and one referenced tool (chrome-use) is a third-party personal-repo curl|sh installer with weaker provenance than the rest of the stack. Not clearly malicious, but high-risk due to financial-session access, destructive sheet writes, and external automation trust.