testrail

SUSPICIOUS. The skill’s capabilities fit its TestRail sync purpose, and the credential scope is proportionate for a TestRail integration. The main risk is trust in the manually enabled testrail-mcp server: credentials and test data flow through an MCP component whose official same-org provenance is not established by the provided evidence. No clear exfiltration, stealth, or malicious mismatch is shown, but the unverified integration keeps overall risk at medium.