alpaca

SUSPICIOUS: The skill is internally coherent and uses mostly legitimate distribution paths for a brokerage connector, but it enables high-impact financial actions and includes transitive skill installation plus optional credential routing through Zapier. Not malicious from the provided evidence, but high-risk due to autonomous trading capability.