warmysender

SUSPICIOUS. The core MCP connection to warmysender.com is coherent with the stated outreach purpose, and most secret/file findings are benign documentation artifacts. The main risk is disproportionate trust expansion: the skill additionally instructs installation of a separate GitHub-hosted skill from a differently named publisher, creating a transitive trust chain without clear necessity. This is not confirmed malware, but it is a meaningful security risk for an AI-agent skill.

No direct malware or obfuscated code is present in the supplied metadata. It does configure an external hosted MCP service with broad outreach and lead-management capabilities, creating meaningful privacy, authorization, unsolicited-contact, and third-party trust risks. Review the unavailable skill files, MCP OAuth scopes, service ownership, data retention, and consent controls before use.