openfinclaw-ai-quant-research

SUSPICIOUS. The skill’s capabilities broadly match its stated quant-research purpose, and data flows go to OpenFinClaw-branded domains rather than unrelated exfiltration endpoints. However, install trust is only moderate: the CLI is pulled via mutable npm @latest, source provenance is not strongly same-org, and the skill forwards/persists an API key in local config and CLI args. This looks more like a legitimate but higher-trust proprietary integration than overtly malicious behavior.