add-gmail-agent

SUSPICIOUS. The skill’s capabilities mostly align with its stated purpose of adding Gmail access, and the package appears to come from a real same-publisher npm/GitHub project. However, it expands the agent into high-impact email actions, uses an unpinned npx-installed third-party MCP server, and grants that code access to OAuth tokens, mailbox contents, attachments, and outbound sending. This is not clearly malicious, but it is a meaningful security risk and broader than a minimal optional add-on.