website-cloner

SUSPICIOUS: the skill's stated website-cloning workflow is broadly coherent, but it depends on an unpinned external MCP package whose current official provenance is unclear from primary docs. No clear credential harvesting or exfiltration is present, but the transitive install/execute path raises medium supply-chain risk.