ai-trader-tradesync

SUSPICIOUS. The skill's trading-sync purpose broadly matches its API usage, but its delivery model is risky: mutable remote skill fetches, unpinned plugin installation, and unverifiable package provenance weaken trust. Credential flow goes to same-project domains rather than an obvious exfiltration host, so this is not confirmed malware, but the install path and autonomous trade broadcasting make it high security risk.