startup-idea-validator

SUSPICIOUS: the skill's overall purpose is coherent, but it combines unpinned third-party MCP installation, credential forwarding, intermediary AI-query routing, transitive skill loading, and heavy ingestion of untrusted web content with write/exec capability. This looks more like a high-risk research automation skill than malware, with the main concerns being supply-chain trust and indirect prompt-injection exposure rather than clear malicious intent.