website-visitors

SUSPICIOUS. The skill’s purpose and capabilities are mostly coherent for website visitor tracking, and its stated API endpoint aligns with the vendor’s own domain. The main concern is install/execution trust: it asks the agent to auto-run an unpinned external MCP package whose exact provenance was not independently verified, while also passing an API key to that package. No direct malware, stealth, or clear exfiltration behavior is present in the skill text.