mobilebuildmcp-runtime-boundary-review

SUSPICIOUS: The skill’s purpose and file access are coherent for a review-only workflow, but the validation step adds medium supply-chain risk by running an unpinned third-party npx tool unrelated to the publisher. No clear credential harvesting or malicious data exfiltration is present.