pp-numista

SUSPICIOUS: the skill's Numista-related capabilities mostly fit its stated purpose, but its trust model is weak because it depends on installing and using an external CLI/MCP binary that is not verifiable from this artifact, then forwarding Numista credentials and account data to it. Optional arbitrary webhook delivery further expands data-exfiltration risk beyond normal API usage.