read-github

SUSPICIOUS: the skill’s purpose mostly matches its capabilities, but its core data flow relies on the third-party gitmcp.io intermediary and an unprovided local wrapper script. The biggest concerns are intermediary routing, unverifiable execution of scripts/gitmcp.py, and expanded prompt-injection surface from fetching arbitrary linked URLs; there is no clear evidence of credential theft or outright malware.

No direct malware indicators such as credential theft, persistence, reverse shells, destructive file operations, or covert exfiltration are present. The principal risks are supply-chain exposure from 'npx -y mcp-remote', unrestricted interaction with user-selected MCP endpoints and tools, and possible SSRF through the remote fetch tool. The code also contains a likely NameError caused by the bare epilog identifier.