blofin-setup

SUSPICIOUS: The skill’s stated purpose matches BloFin setup, and the API endpoints are official, but the actual MCP server being installed is not verifiably official. The combination of unverified package/repo provenance, direct forwarding of exchange credentials, and support for trade/transfer scopes makes the skill high risk and disproportionate for a generic setup guide unless the publisher and package ownership can be independently verified.