edge-hint-extractor

This module is primarily a deterministic data-processing/aggregation tool that generates a YAML file from local JSON/CSV inputs. There is no direct evidence of hidden malware, credential theft, network exfiltration, or system-damaging actions in the provided code. However, the presence of an intentional arbitrary external command execution capability (--llm-ideas-cmd) is the dominant security concern: if CLI arguments can be influenced in a CI/pipeline or automation context, an attacker could run arbitrary programs with the current user’s privileges and receive the derived local payload via stdin. YAML parsing uses yaml.safe_load (safer than unsafe loaders), so the main risk is execution and data exposure via the subprocess, not YAML deserialization.

SUSPICIOUS. The stated purpose is coherent for local market-data transformation, and the default/local-file workflow looks benign. Risk comes from the optional arbitrary external LLM command: it is underdocumented, unverified, and can route input data to unknown third-party code, making the skill moderately risky even without direct credential handling.