mcp-app-dev-setup

SUSPICIOUS: The skill’s capabilities largely fit its dev-setup purpose, and there is no clear exfiltration or stealth behavior. Risk comes from cloning and executing an unpinned, not-publicly-verifiable Forge repo and then using real cluster credentials with that code; this is a medium supply-chain and credential-forwarding concern, not confirmed malware.