earnings-orchestrator

SUSPICIOUS. The skill’s capabilities generally fit its stated orchestration purpose, and there is no explicit credential harvesting or remote payload download. However, `dontAsk` autonomy, automatic Bash-triggered hooks, and reliance on unverifiable local scripts and downstream skills create meaningful execution-trust risk disproportionate to a simple research coordinator.