vector-init-applications

SUSPICIOUS. The skill’s capabilities are mostly aligned with its stated purpose and file access is proportionate, but it routes personal CRM data through a custom, unverifiable `jungle-personal` Pinecone MCP path rather than a clearly official/publicly verifiable endpoint. No direct malware behavior or credential theft is shown, yet the remote data transfer and custom MCP trust gap create medium security risk.