list-building-prospeo

SUSPICIOUS: the skill’s purpose, capabilities, and official endpoint usage are largely coherent, but it relies on an unpinned npm-delivered MCP package and forwards an API key to that external runtime component without clear package provenance verification in the provided evidence. This looks more like supply-chain and credential-trust risk than confirmed malicious behavior.