capacitor-mcp

SUSPICIOUS: the skill is largely aligned with its stated Ionic/Capacitor automation purpose, but it relies on an unpinned third-party MCP package executed via `npx` and optionally forwards a GitHub token into that package. Data flows and capabilities are plausible for the use case, so this is not confirmed malware, but the install trust and credential-forwarding model make it a medium-to-high security risk.