finta-debug-bundle

SUSPICIOUS. The skill’s general purpose is plausible, and it does not fetch or run third-party code, but its actual footprint is broader than advertised: it forwards a live API key to endpoints whose version/path do not match the retrieved official API docs, and it archives raw investor/round/integration payloads despite claiming minimal redacted collection and financial-data boundaries. This looks more like an overbroad diagnostic script than confirmed malware.