trader-train

SUSPICIOUS: the skill’s purpose and capabilities mostly align, but it relies on unpinned runtime installation and execution of a third-party npm trading CLI, which creates medium supply-chain risk. No clear credential harvesting, exfiltration, or direct trading automation is shown, so this is not confirmed malware.