tradingcodex-investment-workflow

The skill is broadly coherent with its stated purpose: it sets up a local investment-research and order-management workflow, and the requested credentials match broker/data use cases. The main concerns are supply-chain trust and execution of third-party package code, especially the unpinned GitHub `@main` install path and optional provider extensions; these raise meaningful security risk but do not by themselves indicate malware. Overall classification: SUSPICIOUS due to medium supply-chain risk and the presence of optional live financial execution, though data flow appears local-first and not obviously routed to unrelated third-party endpoints.