alpaca-trading-mcp

SUSPICIOUS. The capability matches the stated purpose and the main package appears to be the official Alpaca MCP server from a public registry, so this is not confirmed malware. Risk is still high because the skill enables real-money autonomous trading and uses a remote pipe-to-shell installer for uv, though data flow appears proportionate and directed to official Alpaca infrastructure rather than an unrelated intermediary.