amazon-sorftime-research-mcp-skill

SUSPICIOUS. The skill’s capabilities are broadly aligned with Amazon research, and Sorftime/Sif integration looks plausibly official. However, it routes credentials in URL query strings, includes a less-verifiable Xiyou MCP endpoint, and uses unpinned Python dependencies. This is not confirmed malware, but the install/data-flow trust is only partial and warrants caution.