bmob-mcp

SUSPICIOUS: The skill is broadly purpose-aligned with Bmob administration, and the endpoints/headers appear documented by Bmob, but it forwards sensitive credentials to a remote MCP endpoint over plain HTTP and enables live destructive/deployment actions. The main issue is insecure transport and remote-command trust, not clear malware.