why

SUSPICIOUS. The skill's stated purpose matches its investigative behavior, and there is no direct malware pattern or unsafe installer. However, it is high-footprint for a research skill: it enumerates all available MCPs, runs with agent-mode access, and fans internal context out to multiple possibly third-party systems by default. The main concerns are broad data flow, reliance on unvetted MCP trust boundaries, and prompt-injection exposure from external content rather than confirmed malicious intent.