mcp-quickstart-scaffolder

SUSPICIOUS: the skill’s capabilities mostly match its stated scaffolding purpose, and data flows go to expected npm/API/Cloudflare paths. The main concerns are executing mutable third-party npm code, handling pasted API-bearing curl commands, and a publisher/provenance mismatch between ara.so branding and the personal GitHub package source.