atlas-cloud

SUSPICIOUS: The skill is largely coherent with its stated Atlas Cloud integration purpose and uses official Atlas domains, but it asks the agent/user to execute an unpinned npx MCP package and pass ATLASCLOUD_API_KEY into that external package. The separate skills-install path adds transitive trust. This is not confirmed malware, but it has meaningful supply-chain and credential-forwarding risk beyond a simple API guide.