analyze-crypto

SUSPICIOUS. The skill’s purpose and capabilities mostly align: web research, report writing, and local PDF generation fit a crypto analysis workflow. The main concerns are disproportionate Bash availability plus an unpinned `npx -y md-to-pdf` fallback that executes third-party code, and prompt-injection exposure from processing untrusted web content while retaining write/exec capability. No credential harvesting, exfiltration endpoint, wallet-draining logic, or autonomous trading behavior is present.