stockly

SUSPICIOUS: the skill's basic purpose is plausible, and the CLI comes from an official npm package, but the actual integration is a Membrane-mediated proxy rather than a direct Stockly integration. That means Stockly authentication context and API traffic flow through a third-party service, which is disproportionate to a narrowly scoped Stockly skill and creates medium supply-chain and data-routing risk.