mcp-management

SUSPICIOUS. The skill’s purpose broadly matches its capabilities, but it relies on an external Gemini CLI install path that appears inconsistent with official publisher guidance and then uses that CLI to auto-execute MCP tools with confirmation bypass. The main concern is supply-chain trust and delegated autonomous tool execution, not confirmed malware.

No direct evidence of explicit malware is present in this module (no obfuscation, no eval/dynamic code execution, no external network calls, and no hardcoded credentials). However, the design creates a high-impact execution surface: it trusts a local JSON config to supply the exact command/args/env used to start MCP servers via stdio, with no allowlisting or validation. If an attacker can tamper with the config file or influence the working directory/config path, this can become an arbitrary local command execution vector. Additionally, tool/prompt/resource invocation inputs and resource URIs are forwarded without validation, increasing the potential blast radius if the MCP server (or inputs) are malicious or compromised.