signals

SUSPICIOUS. The stated purpose matches consuming trading signals, but the core dependency is an unverifiable external CLI installed from an unverified tap, and the skill forwards optional local NATS credentials into that binary. Its explicit use for trading-bot decisioning also raises real-world action risk. No confirmed credential theft or overt exfiltration is shown, so this is high-risk vulnerable behavior rather than confirmed malware.