sdr-outbound-rules

SUSPICIOUS: The skill’s purpose and data flows are mostly coherent for outbound-writing support, and it points to the vendor’s own domains rather than an unrelated proxy. However, it asks users to run an unpinned `npx @latest` MCP package and provide an API key to that runtime-fetched code, with package provenance not independently verified in the provided evidence, making this a medium supply-chain and credential-forwarding risk rather than clearly benign.