retirement-income

SUSPICIOUS: the skill is purpose-aligned and does not show malware-like behavior, local payload execution, or disproportionate permissions, but it routes sensitive financial data to a third-party remote MCP whose server-side logic is unverifiable here. The integration is coherent for retirement planning, yet the remote-service trust model and credential forwarding to PlanFi create medium security/privacy risk rather than a clearly benign local-only skill.