rent-vs-buy

SUSPICIOUS: The skill is purpose-aligned and shows no direct malware behavior, but its actual footprint relies on a third-party MCP endpoint that receives sensitive personal finance data and optionally API credentials. The main risks are transitive trust, credential forwarding, and remote data handling to a not-strongly-verified service, not overt malicious intent.