treasury-reporting-rate

SUSPICIOUS: the skill’s purpose is coherent, but its footprint is broader than a simple Treasury-rate lookup because it downloads remote code, uses a third-party paid gateway instead of the official Treasury API, and can sign payment authorizations with a wallet key stored in plaintext. This is not confirmed malware, but it carries meaningful supply-chain, credential-handling, and financial-action risk.