mcp-discovery

SUSPICIOUS: the skill is coherent with its stated purpose, but its purpose is to install and activate third-party MCP servers, creating notable transitive supply-chain and tool-surface expansion risk. The official registry and zero-env restriction reduce credential risk, but the mandatory registry-first behavior and lack of visible package verification keep overall risk elevated.