tradingview-api-integration

SUSPICIOUS. This deprecated skill is small and not directly malicious, but its whole purpose is to redirect the user into installing another skill from an external GitHub repo. The main risk is transitive trust: the replacement inherits agent permissions and shifts trust to a non-official TradingView source, with evidence that the broader replacement ecosystem uses third-party TradingView-data endpoints rather than official APIs. No direct command injection, credential theft, or hidden execution appears in this wrapper itself.

No malware or sabotage behavior is present in this documentation fragment. The primary security issue is possible exposure of a usable JWT in the example and the recommended placement of that token in an SSE URL query parameter. Treat the token as compromised, revoke or rotate it if valid, and prefer a safer authentication mechanism where supported.