longbridge

SUSPICIOUS: The skill is broadly aligned with its finance purpose and appears same-org official, but it carries meaningful risk from transitive skill installation, external CLI dependence, and authenticated account/trade scope. No clear credential exfiltration or malicious data routing is evident, so this is not confirmed malware.