ground-news

SUSPICIOUS: The purpose is coherent, but the implementation footprint is only partly aligned. Official 1Password secret access is legitimate, yet the skill relies on an unverified Ground News API, unspecified MCP components, and a disproportionate IMAP fallback that reads and mutates mailbox state for a news task. This looks more like an incomplete/overbroad integration than malware, but its credential and data-flow boundaries are not well-defined.