n8n

SUSPICIOUS: the core skill is mostly benign local routing/documentation for n8n, but it contains vendor-biased instructions to run an unpinned external MCP package and forward an API key to it. The data endpoints are same-org and not obvious exfiltration infrastructure, so this is not confirmed malware, but the install-trust and credential-forwarding risks are disproportionate to a general n8n guidance skill.