bank-sync

SUSPICIOUS. The skill's core capability fits its purpose and uses Plaid in a plausible way, but it handles highly sensitive financial data, stores long-lived tokens locally, enables automatic recurring sync, and makes unverified claims that credentials never leave the machine. There is no direct malware or installer abuse evidence, but the privacy and data-flow assurances are insufficiently substantiated.