stock

SUSPICIOUS. The skill is largely coherent with a stock/trading platform and uses official Longbridge endpoints, so there is no clear credential-harvesting or exfiltration pattern. However, it combines remote-install execution patterns with access to sensitive account/trading capabilities and enables autonomous real-world financial actions, making overall risk medium-to-high even though malicious intent is not established.

The fragment contains documentation only and provides no direct evidence of malware. However, its curl-to-sh and iwr-to-iex installation/update commands execute unreviewed remote content and therefore present a meaningful supply-chain risk. Installation should use signed, versioned artifacts with checksums or signatures and scripts should be reviewed before execution. OAuth token storage and MCP permissions should also be protected and minimized.