investment-memo-writer

SUSPICIOUS: The core memo-writing purpose is benign and the skill does not request credentials or show exfiltration, but its footprint is not fully clean. Main concerns are install-trust issues (`docx` package mismatch, unpinned external installs), third-party skill-registry dependence via `npx clawhub`, and explicit transitive use of other skills plus cron automation that go beyond a narrow writing/template function.