receipt-tracker-setup

SUSPICIOUS: the core receipt-tracking workflow is coherent and the install path is relatively normal, but the skill delegates local file handling and follow-on actions to a remote AI endpoint, runs persistently, suppresses confirmation prompts, and enables automatic email sending. These behaviors are disproportionate enough to raise medium-high security concern, though there is not enough evidence to call it malicious.