finance-district

The skill is purpose-aligned and uses a plausible official npm distribution path, with no clear evidence of hidden exfiltration or unrelated credential theft. Its main risk is that it enables high-impact financial and merchant actions through an external CLI, including OTP-based authentication and API key management, so it should be treated as high-consequence but not malicious.