algo-portfolio

SUSPICIOUS. The skill is internally coherent for portfolio trading and uses a documented OpenAlgo package path rather than an unverifiable binary, so this is not confirmed malware. However, it enables autonomous live trading with account-wide order cancellation/position closure and forwards API credentials to a host that can be redirected by environment variables, making the overall security risk high despite mostly legitimate provenance.