us-stock-data

SUSPICIOUS: the core market-data functionality is broadly consistent with the stated purpose, but the skill’s footprint is not cleanly read-only. The main concerns are exposed Alpaca credentials, inclusion of trading capability in a data-query skill, and optional installation of a third-party MCP service. This is not confirmed malware, but it poses high security risk and should not be used without removing embedded secrets and separating trading features from the data skill.