investment-analysis

No direct malicious payload is visible in this installer wrapper. The dominant risk is supply-chain execution: it clones and auto-updates an unpinned GitHub repository and symlinks its skill entry into the host runtime location, and—when npm is present—runs `npm install` in the dashboard directory (which can execute arbitrary lifecycle/dependency install scripts). Lack of integrity pinning/verification and reduced npm audit visibility further increase the likelihood that a compromised upstream could result in local compromise through install-time code execution.

SUSPICIOUS: the skill’s core purpose is coherent, but it has medium security risk because it combines untrusted web/social ingestion, multi-agent execution, local file writes, background servers, and an unreviewed npm install path. It is not confirmed malicious: no credential harvesting, exfiltration endpoint, stealth directive, or trade execution is present.

No clear evidence of intentional malware behavior (no exfiltration, backdoors, or credential theft observed). However, this module has a strong client-side DOM XSS risk: it embeds window.REPORT_DATA from a templating placeholder and then renders many REPORT_DATA fields into the DOM via innerHTML without visible sanitization/escaping. If report content can be influenced by an attacker, arbitrary script execution in the viewer’s browser is plausible. External CDN loading (Chart.js) increases supply-chain surface but is not the primary issue in this fragment.