mcporter-hardened

SUSPICIOUS. The skill is purpose-aligned as an MCP client and uses a legitimate npm distribution path, so it is not clearly malicious. However, it gives the agent broad power to contact arbitrary MCP URLs, broker OAuth, execute ad-hoc stdio subprocesses, and potentially forward environment-backed secrets or sensitive tool output to third-party servers; this is a coherent but high-impact footprint that warrants caution.