Trading Analyzer

This skill appears to do what it claims (combine TradingView, Alpha Vantage, Yahoo data) but has several inconsistencies and supply-chain risks you should consider before installing or running any commands it recommends: - Metadata mismatch: the registry lists no required env vars but the README/SKILL.md require ALPHAVANTAGE_API_KEY. Treat that as a correctness/quality issue — ask the publisher to update metadata. - External code execution: the skill tells you to run mcporter and to call MCP packages via npx or install mcporter via Homebrew. Those commands will download and execute third-party code (npm packages, brew taps). Only run them if you trust the package authors and have inspected the packages or run them in a sandbox. - Protect secrets: if you provide ALPHAVANTAGE_API_KEY, avoid putting high-privilege credentials in global shell profiles or shared config. Use a scoped API key, limited permissions/rate limits if possible, and prefer storing secrets in a secure credential store rather than plaintext files. - Verify package names and sources: SKILL.md/README use inconsistent server/package names (tradingview-mcp vs tradingview-m etc.). Before running npx install commands, verify the exact package names and author/publisher on npm and Homebrew (look up the steipete tap and npm authors). Prefer pinned versions over '@latest'. - If you need higher assurance: ask the skill author for a source repo or homepage, inspect the mcporter and MCP packages manually, run commands in an isolated VM/container, or decline to install. Given the unknown source and the instructions to fetch and execute external packages, treat this skill as suspicious until you can validate the origins and the exact packages it will run.