trade-report-pdf

SUSPICIOUS. The core behavior is broadly consistent with a PDF report skill and there is no explicit credential harvesting or exfiltration, but the trust model is weakened by dependence on an external local script and a broader same-publisher installation flow that uses raw GitHub pipe-to-shell. Risk is mainly supply-chain/install trust rather than malicious intent.