setup

SUSPICIOUS. The skill’s capabilities mostly match its stated setup purpose and there is no clear exfiltration or covert behavior, but its install footprint is broader and less trustworthy than necessary: many unpinned dependencies, OS-level package/build steps, an outdated HTTP SourceForge TA-Lib source URL, and an optional third-party Windows wheel download. Secret handling is local to `.env` and proportionate to the backtesting use case, but overall install trust is only medium and should be treated cautiously.