@2004/tqx-quant

SUSPICIOUS. The skill’s capabilities mostly match its quant/backtest purpose and it routes data to first-party TQX endpoints, but it depends on a partially unverifiable external CLI and forwards full login credentials to it. The main risk is credential exposure and trust in the CLI, not confirmed malware or overt exfiltration.