polytrackers-agent-skill

SUSPICIOUS: the skill is largely coherent with its stated trading purpose and routes data to same-service endpoints, but it installs an unpinned npm bridge and forwards API credentials to that external tool while also enabling real financial actions. This looks proportionate rather than malicious, but the trust and financial-action risks are material.