meigen-ai-design-mcp

SUSPICIOUS: the core capabilities fit an AI design skill, but the trust footprint is broader than a simple prompt helper. It installs transitive marketplace components, executes a remote CLI via `npx`, forwards API keys through that tool, and uploads local images to cloud services. The behavior is mostly purpose-aligned, so this is not confirmed malware, but provenance and credential-routing risks make it a medium-risk skill.