albumentationsx-mcp

SUSPICIOUS. The skill’s capabilities mostly match its stated local preview purpose and it avoids obvious credential abuse, but it depends on executing a community MCP package from PyPI via uvx. That supply-chain footprint is proportionate yet not fully anchored to the official Albumentations org, and export/evidence behaviors are not fully described, so risk is medium rather than benign.