daily-investment-report

SUSPICIOUS/HIGH RISK. The core reporting purpose is plausible, but the skill is over-scoped: it combines market scraping, local secret access, remote VPS relaying, disabled SSH verification, scheduled outbound messaging, and portfolio/trading workflows. Direct calls to official APIs would be proportionate; routing credentials and report data through a raw-IP VPS with weakened SSH checks is not.

No definitive malicious payload is evident (no reverse shell, persistence, or overt data-theft beyond use of an API key). However, the workflow includes defense-evasion guidance, hardcoded external relay infrastructure, disabled SSH host key verification, and cross-system handling of a sensitive API token. This combination elevates operational/supply-chain security risk and should be reviewed and hardened (remove scan-bypass instructions, avoid unnecessary relays, protect API keys, and enforce SSH host verification).